BUILD_RC=0
== DF-4194: drm_mode_create_tile_group() ERR_PTR vs NULL-check mismatch ==

kernel: drm_mode_create_tile_group() returned  ERR_PTR(-ENOMEM) = 0xfffffffffffffff4
caller: if (!tg) return -ENOMEM;  -> tg is non-NULL, so the check PASSES (bug: ERR_PTR slips through).
caller SHOULD have used IS_ERR(tg) == 1 -> the bug.

connector->tile_group = tg;   /* stored: 0xfffffffffffffff4 */

[crash site 1] drm_connector.c:1490 snprintf("%d", connector->tile_group->id)
    effective address = tg + offsetof(id) = 0xfffffffffffffff4 + 16 = 0x4

[crash site 2] kref_put(&tile_group->refcount) at drm_edid.c:5148/5219,
                                       drm_connector.c:388
    effective address = tg + offsetof(refcount) = 0xfffffffffffffff4 + 0 = 0xfffffffffffffff4

Both are fixed, unmapped kernel addresses -> deterministic page fault
(kernel panic) the moment any of the four sites executes.
Sites are reached on the NEXT probe with the same monitor, on probe of a
different monitor (out_drop_ref), at driver unload (cleanup), or — for DP
MST — immediately in drm_connector_set_tile_property().
RUN_RC=0