DF-4194 evidence pack — DRM tile-group ERR_PTR/NULL contract mismatch

Finding: drm_mode_create_tile_group() (sys/dev/drm/drm_connector.c:1917,1929)
returns ERR_PTR on failure while its only caller drm_parse_tiled_block()
(sys/dev/drm/drm_edid.c:5141) checks only "!tg" — the upstream-Linux-v5.2
NULL contract. The ERR_PTR is stored in connector->tile_group (drm_edid.c:5150)
and later dereferenced/kref_put by four sites, panicking the kernel at fixed
unmapped addresses (0xfffffffffffffff4 / 0x4).

Contents:
  trigger.c   userspace demonstration of the mismatch + exact fault addresses
              (layout of struct drm_tile_group, ERR_PTR(-ENOMEM) arithmetic)
  build.sh    build command (runs on the DFBSD guest; any unix works)
  run.sh      run command
  build.log   full untrimmed compiler output (guest: DragonFly cc/gcc)
  run.log     full untrimmed output of the decisive run (guest)
  env.txt     guest uname + DRM-absence proof (no /dev/dri, no drm kmod,
              only QEMU virtio-vga)
  fix.diff    git-apply-able one-line-per-path fix vs sys/dev/drm/drm_connector.c
              (authored post-verification; never applied to sys/)
  VERDICT.md  full narrative with line citations and crash-site table
  manifest.json / verdict.json  machine-readable records

Expected output of ./run.sh: the ERR_PTR value 0xfffffffffffffff4 shown to
pass the caller's NULL check, and the two computed fault addresses
(0xfffffffffffffff4 for the kref_put sites, 0x4 for the ->id sites).

Status: untested at the kernel level on this guest (no DRM hardware —
hardware-gated), source-level certain.