--- a/sys/dev/drm/radeon/radeon_uvd.c
+++ b/sys/dev/drm/radeon/radeon_uvd.c
@@ -760,6 +760,13 @@ static int radeon_uvd_send_msg(struct rad
 	ib.length_dw = 16;
 
 	r = radeon_ib_schedule(rdev, &ib, NULL, false);
+#ifdef DF4501_FAULT_INJECTION
+	/* DF-4501 verification aid (NOT a fix): emulate every real
+	 * radeon_ib_schedule() error path leaving ib.fence == NULL.
+	 * Build a kernel with -DDF4501_FAULT_INJECTION, run
+	 * ./uvd_sendmsg_nullfence, expect a near-NULL write panic at
+	 * fd close (radeon_uvd_free_handles -> get_destroy_msg -> here).
+	 */
+	r = -EINVAL;
+#endif
 
 	if (fence)
 		*fence = radeon_fence_ref(ib.fence);