# DF-4215 — dc construct() OOM failure path dereferences NULL current_state / NULL ctx in destruct() → probe-time panic

- **File**: `sys/dev/drm/amd/display/dc/core/dc.c`
- **Lines**: 519–538 (destruct), 569–620 (construct allocs + `goto fail`), 686–689
- **Class**: NULL pointer dereference on error path (CWE-476/CWE-755)
- **Hardware gate**: AMD GPU (amdgpu DC core); trigger = allocation failure during `dc_create()`

## Root cause

`construct()` performs six kzallocs in sequence (`bw_dceip` 569, `bw_vbios`
577, `dcn_soc` 585, `dcn_ip` 593, `dc_ctx` 602, `current_state` =
`dc_create_state()` 615). **Every** failure does `goto fail` →
`destruct(dc)` (686–689). But `destruct()` unconditionally dereferences the
very things that may not exist yet:

```c
static void destruct(struct dc *dc)
{
	dc_release_state(dc->current_state);       /* 521: NULL if 615 failed */
	...
	if (dc->ctx->gpio_service)                 /* 528: NULL ctx if 602 failed */
		dal_gpio_service_destroy(&dc->ctx->gpio_service);
	if (dc->ctx->i2caux)                       /* 531 */
	...
```

- If the `dc_ctx` allocation (602–606) fails, `dc->ctx == NULL` — yet 521
  runs first: `dc_release_state(NULL)` → `kref_put(&context->refcount, …)`
  (`dc.c:1103-1106`) reads through the NULL pointer → page-fault panic.
- If `dc_create_state()` fails (615–620), `dc->current_state == NULL` →
  same panic at 521.
- Even if current_state were guarded, `dc->ctx->gpio_service` (528),
  `dc->ctx->i2caux` (531), `dc->ctx->created_bios` (534), `kfree(dc->ctx)`
  (537) all deref a possibly-NULL `dc->ctx`.

`dc_create()` (729–775) then propagates: `construct_fail: kfree(dc); return
NULL` — so with the guards in place the driver degrades gracefully to
"Display Core failed to initialize" (`amdgpu_dm.c:440-444`); without them, a
single failed kzalloc during GPU probe panics the kernel.

Note `ASSERT_CRITICAL`/`ASSERT` are `WARN_ON`-only in this tree
(`os_types.h:59-77`), so nothing else arrests the path first.

## Verification status

**untested — hardware-gated** (guest's only GPU is the bochs VGA `1234:1111`,
`env.txt`; amdgpu DC never initializes, and an OOM at exactly this probe
window would additionally be needed). Source-certain.

## Fix

`fix.diff`: NULL-guard `dc->current_state` and every `dc->ctx` deref in
`destruct()`.