{
  "finding_id": "DF-4194",
  "title": "drm_mode_create_tile_group() ERR_PTR vs NULL contract mismatch poisons connector->tile_group -> wild-pointer deref (kernel panic)",
  "file": "sys/dev/drm/drm_connector.c",
  "verdict": "untested_kernel_level_source_certain",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O2 -Wall -o trigger trigger.c   (or on the guest: build.sh)",
    "run": "./trigger   (or run.sh)",
    "expected": "Shows ERR_PTR(-ENOMEM)=0xfffffffffffffff4 passing the caller's 'if (!tg)' NULL check, and the computed fault addresses of the four kernel crash sites: 0xfffffffffffffff4 (kref_put sites) and 0x4 (->id sites)."
  },
  "kernel_refs": [
    "sys/dev/drm/drm_connector.c:1909",
    "sys/dev/drm/drm_connector.c:1917",
    "sys/dev/drm/drm_connector.c:1929",
    "sys/dev/drm/drm_edid.c:5120",
    "sys/dev/drm/drm_edid.c:5137",
    "sys/dev/drm/drm_edid.c:5141",
    "sys/dev/drm/drm_edid.c:5144",
    "sys/dev/drm/drm_edid.c:5148",
    "sys/dev/drm/drm_edid.c:5150",
    "sys/dev/drm/drm_edid.c:5204",
    "sys/dev/drm/drm_edid.c:5218",
    "sys/dev/drm/drm_connector.c:387",
    "sys/dev/drm/drm_connector.c:388",
    "sys/dev/drm/drm_connector.c:1489",
    "sys/dev/drm/drm_connector.c:1490",
    "sys/dev/drm/drm_dp_mst_topology.c:1219",
    "sys/dev/drm/drm_dp_mst_topology.c:2566",
    "sys/dev/drm/drm_fb_helper.c:2388"
  ],
  "artifacts": [
    "trigger.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt",
    "fix.diff", "VERDICT.md", "README.md", "manifest.json", "verdict.json"
  ]
}