# DF-4202 VERDICT — unchecked drm_cvt_mode() NULL derefs

**Verdict: not reproduced at runtime (hardware-gated + OOM-gated);
source-level certainty: certain. Impact if exercised: kernel NULL-deref
panic (DoS) in the connector get_modes path.**

## Why certain at source level

- `drm_cvt_mode()` (drm_modes.c:143-169) returns NULL exactly when
  `drm_mode_create()` (drm_modes.c:66-80) returns NULL — kzalloc failure or
  `drm_mode_object_add()` (IDR) failure. The function's own doc comment
  states it "Returns NULL when no mode could be allocated."
- Site 1 (`amdgpu_connector_lcd_native_mode`, amdgpu_connectors.c:405-407):
  `mode->type = ...` writes through NULL immediately.
- Site 2 (`amdgpu_connector_add_common_modes`, :459-460):
  `drm_mode_probed_add(connector, mode)` is defined as
  `list_add_tail(&mode->head, &connector->probed_modes)` — a NULL+offset
  write.
- Both functions run from the LVDS/eDP no-EDID fallback on every connector
  probe (lvds_get_modes :668/:676, dp_get_modes :1251/:1259), i.e. the
  standard path for a laptop panel whose EDID read fails, and the common
  modes loop alone makes 17 consecutive mode allocations per probe.

## Runtime attempt

`trigger_df4202.c` built cleanly (guest cc 8.3) and ran; the audit guest
exposes no DRM device (`/dev/dri` absent, no AMD/ATI PCI devices —
env.txt), so the amdgpu get_modes path cannot execute there. Deterministic
reproduction needs an amdgpu LVDS/eDP machine driven into kernel memory
exhaustion while probing — same OOM gating as the radeon twin DF-4035,
which upstream fixed by adding the exact `if (mode)` guards this pack's
fix.diff adds.

## Fix validation

Not possible on this guest. `fix.diff` verified to apply cleanly to a
pristine copy of the real file (cumulative with DF-4200/DF-4201 diffs).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.