# DF-4161 — missing `!conn_state->crtc` guard in intel_panel_set_backlight → vlv_set_backlight NULL deref via unprivileged `hw.backlight_level` sysctl

File: `sys/dev/drm/i915/intel_panel.c` (pass 2)

## What
`intel_panel_set_backlight()` (intel_panel.c:1148-1170) is the only live caller-fed
entry into `panel->backlight.set()` that does NOT check `conn_state->crtc`. Its ACPI
sibling `intel_panel_set_backlight_acpi()` (:620-654) carries exactly that guard
(:634) with the comment *"Lack of crtc may occur during driver init because
connection_mutex isn't held across the entire backlight setup + modeset readout,
and the BIOS can issue the requests at any time."* On DragonFly the "request at
any time" caller is the DFly-specific sysctl `hw.backlight_level`
(`sysctl_backlight_handler`, :1811-1841, `CTLFLAG_RW | CTLFLAG_ANYBODY` — writable
by ANY local user).

On VLV/CHV (Valleyview/Cherryview, non-DSI connectors) the selected `.set` hook is
`vlv_set_backlight()` (:577-586):

```c
enum i915_pipe pipe = to_intel_crtc(conn_state->crtc)->pipe;   /* :581 — NULL deref */
```

while the read side is defended (`intel_get_pipe_from_connector` returns
INVALID_PIPE for a NULL crtc, intel_display.c:14158-14168, and `_vlv_get_backlight`
WARN_ONs and returns 0, :497-503). No other `.set` implementation derefs
`conn_state->crtc`, which is why the guard's absence only bites VLV/CHV.

## Preconditions (hardware state)
* VLV/CHV i915 with LVDS/eDP panel, `pm_method` = register PWM (not DSI-pwm).
* `panel->backlight.enabled == true` with `connector->base.state->crtc == NULL`.
  `enabled` is seeded from the BIOS handoff at setup
  (`panel->backlight.enabled = ctl2 & BLM_PWM_ENABLE`, :1662) — independent of any
  DRM atomic commit. A panel the BIOS left lit that was never (or is currently
  not) bound to a CRTC in the connector state satisfies both. `present` is true
  after any successful setup (:1875).
* The sysctl write must change the value (`val != user_level`), be `>= 0` and
  `<= max_brightness` (:1834) — trivially arranged by any local user.

## Trigger (to run on VLV/CHV hardware)
```
./trigger.sh
```
expects `hw.backlight_level` to exist; writes a fresh value as an unprivileged
user. On a vulnerable kernel the expected result is a kernel page fault at
`to_intel_crtc(NULL)->pipe` inside `vlv_set_backlight` (near-NULL read) → panic.

## Status on this audit guest
Hardware-gated: the QEMU guest has virtio VGA only (no 0x8086 display device,
`hw.drm`/`hw.backlight_level` unknown oids — see env.txt). Per the DF-4022 family
convention the finding is source-certain / runtime-inconclusive.

## Fix
See fix.diff: mirror the `_acpi` guard in `intel_panel_set_backlight()` and add a
defensive `WARN_ON(!conn_state->crtc)` in `vlv_set_backlight()`.