# DF-4201 VERDICT — NULL encoder deref family (DF-4033 amdgpu twin)

**Verdict: not reproduced at runtime (hardware-gated); source-level
certainty: certain. Impact if exercised: kernel NULL-deref panic (DoS) from
the display-session owner.**

## Proof of the NULL sources

- `amdgpu_connector_best_single_encoder()` (amdgpu_connectors.c:346-357)
  returns NULL when `drm_connector_for_each_possible_encoder` yields
  nothing; `amdgpu_connector_dvi_encoder()` (:1122-1148) returns NULL the
  same way (its type-filter loop can miss, then the fallback "pick the
  first one" loop also finds none).
- Possible encoders are attached only by `amdgpu_link_encoder_connector()`
  (amdgpu_encoders.c:45-56): a connector whose VBIOS device bits match no
  encoder ends with an empty list. The connector is still created and
  registered (`amdgpu_connector_add`, amdgpu_connectors.c:1499-1900 —
  encoder linkage happens later and is never checked).
- `enc_priv` NULL: `dce_v8_0.c:3382`, `dce_v10_0.c:3494`,
  `dce_v11_0.c:3626` all start with `amdgpu_encoder->enc_priv = NULL` and
  only fill it if the atom-parser kzallocs succeed
  (`amdgpu_atombios_encoder_get_lcd_info` /
  `amdgpu_atombios_encoder_get_dig_info`). The coherent-mode handler in
  this very file guards it (`if (!amdgpu_encoder->enc_priv) return 0;`
  amdgpu_connectors.c:484-485) — the monitor-bpc path at :141 does not.

## Consumers of the NULL

- `amdgpu_connector_get_monitor_bpc()` :139-143 — called on every modeset
  from `atombios_crtc.c:773` (crtc prepare), `atombios_dp.c:261`
  (link bpp), `dce_v8_0.c:444` / `dce_v10_0.c:504` / `dce_v11_0.c:530`.
- `amdgpu_connector_set_property()` :583-594 — scaling-mode property write
  (DRM_MASTER-gated ioctls, drm_ioctl.c:667/679).
- `amdgpu_connector_set_lcd_property()` :792-803 — the eDP/LVDS
  `.set_property` for the same property (same ioctls).

`to_amdgpu_encoder(NULL)` = `container_of(NULL, ...)` (amdgpu_mode.h:58);
`base` is the first member, so the :594/:803 `rmx_type` reads fault at a
small fixed offset — deterministic NULL-page panic.

## Runtime attempt

`trigger_df4201.c` compiled and ran on the audit guest (cc 8.3); the guest
has no DRM device at all (`/dev/dri` absent, no AMD/ATI PCI — env.txt), so
the amdgpu connector functions cannot execute there. Triggering on real
hardware needs an amdgpu ASIC whose VBIOS describes an encoder-less
connector (or an encoder whose dig/lcd info allocation failed at probe) —
same VBIOS-quirk gating as the radeon twin DF-4033, which this finding
mirrors site-for-site.

## Fix validation

Not possible on this guest (no AMD GPU). `fix.diff` verified to apply
cleanly to a pristine copy of the real file and is consistent with the
in-file guard patterns (:479-485, :1083).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.