# DF-4581 — radeon_cs_parser_relocs: unchecked radeon_vm_get_bos() NULL return omits VM PD/PTs from the CS reservation set

## Where
`sys/dev/drm/radeon/radeon_cs.c:190-192`:

```c
if (p->cs_flags & RADEON_CS_USE_VM)
        p->vm_bos = radeon_vm_get_bos(p->rdev, p->ib.vm, &p->validated);
```

No NULL check. `radeon_vm_get_bos()` (`sys/dev/drm/radeon/radeon_vm.c:128-138`)
returns NULL when its `kvmalloc_array()` fails — after having added **nothing**
to `&p->validated`.

## Consequence on failure
* VM page directory + page tables are missing from `p->validated`:
  never `ttm_eu_reserve_buffers`-reserved, never validated/pinned, and never
  fenced by `ttm_eu_fence_buffer_objects` (`radeon_cs.c:427`).
* Submission proceeds anyway: `radeon_cs_ib_vm_chunk` →
  `radeon_bo_vm_update_pte` (`radeon_cs.c:565`) →
  `radeon_vm_update_page_directory` builds a DMA IB writing PDEs at
  `pd_addr = radeon_bo_gpu_offset(pd)` — a BO whose placement is not held
  for this submission. Concurrent eviction can move the PD/PT BOs (their
  reservations are free) → the GPU writes PDEs at a stale address
  (freed/reused VRAM/GTT memory of another client), and the PTs can be
  evicted while the IB still executes. Race-grade GPU memory corruption,
  trigger-gated behind an allocation failure.

## Reachability on this tree (important, honest caveat)
On DragonFly as compiled, `kvmalloc_array(..., GFP_KERNEL)` cannot return
NULL: `GFP_KERNEL` = `M_WAITOK` without `M_NULLOK`
(`sys/dev/drm/include/linux/gfp.h:40`), so failure panics or hangs instead
(see DF-4580). The NULL path is therefore **latent on DF today** and a
**live upstream bug** on Linux; it must be fixed together with any DF-4580
allocator-semantics fix, or fixing one bug silently activates the other.

## Run
No runtime PoC is possible on the audit guest (no AMD GPU, no /dev/dri —
`radeon_cs_ioctl` unreachable) and the NULL path cannot even be forced
without allocator changes. `DF-4581-trace.c` documents the trace and the
fix; verification is by code inspection only.

## Expected result of the fix
`radeon_cs_parser_relocs` returns `-ENOMEM` when `radeon_vm_get_bos` fails,
the ioctl unwinds via `radeon_cs_parser_fini` — no submission with an
unreserved page directory.