# DF-4035 — OOM NULL-deref family: unchecked `drm_cvt_mode()` results in TV/common-mode builders

**File:** `sys/dev/drm/radeon/radeon_connectors.c`
**Severity:** Low (local DoS panic under memory exhaustion; hardware-gated)
**Class:** CWE-476 NULL pointer dereference (same family as DF-1343, distinct sites).

## Root cause (path:line)

* `radeon_tv_get_modes()` (pre-AVIVO branch):

  ```c
  1148:		tv_mode = drm_cvt_mode(dev, 800, 600, 60, false, false, false);
  1149:		tv_mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
  1150:		drm_mode_probed_add(connector, tv_mode);
  ```

  `drm_cvt_mode()` returns NULL on allocation failure; `tv_mode->type` then writes
  through NULL (+small offset).

* `radeon_add_common_modes()` (used by LVDS/DP/TV get_modes on every probe):

  ```c
  549:		mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, 60, false, false, false);
  550:		drm_mode_probed_add(connector, mode);
  ```

  `drm_mode_probed_add()` does `list_add_tail(&mode->head, ...)` — NULL deref inside the
  list helper.

Reachability: any connector probe (unprivileged `DRM_IOCTL_MODE_GETCONNECTOR`, poll
workers) while the kernel heap is exhausted — the attacker sprays kernel memory through
any unprivileged kernel-allocation interface (e.g. long-lived GEM/ttm objects, pipes,
mbuf clusters) before triggering the probe. Hardware-gated to radeon KMS.

## Upstream status

Identical unchecked calls in current Linux master. Unfixed upstream.

## Verification (this pack)

No runnable trigger (needs GPU + deterministic OOM); source-level certainty from the
cited lines. Guest has no radeon GPU (env.txt).

## Suggested fix

`fix.diff`: NULL-check both `drm_cvt_mode()` results.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.