== [1] intel_guc_log_create: only call site is inside #if 0 ==
sys/dev/drm/i915/intel_guc_log.h:86:int intel_guc_log_create(struct intel_guc_log *log);
sys/dev/drm/i915/intel_guc_log.c:452:int intel_guc_log_create(struct intel_guc_log *log)
sys/dev/drm/i915/intel_guc.c:203:	ret = intel_guc_log_create(&guc->log);
	GEM_BUG_ON(!guc->shared_data);

#if 0
	ret = intel_guc_log_create(&guc->log);
	if (ret)
		goto err_shared;
#endif

== [2] log->vma is assigned nowhere else (expect NO output) ==
  (no other assignment — confirmed)
== [3] guc_ctl_log_params_flags dereferences guc->log.vma (:296) ==
static u32 guc_ctl_log_params_flags(struct intel_guc *guc)
{
	u32 offset = intel_guc_ggtt_offset(guc, guc->log.vma) >> PAGE_SHIFT;
	u32 flags;
== [4] called unconditionally from intel_guc_init_params (:359) ==
	params[GUC_CTL_WA] |= GUC_CTL_WA_UK_BY_DRIVER;

	params[GUC_CTL_FEATURE] = guc_ctl_feature_flags(guc);
	params[GUC_CTL_LOG_PARAMS]  = guc_ctl_log_params_flags(guc);
	params[GUC_CTL_DEBUG] = guc_ctl_debug_flags(guc);
	params[GUC_CTL_CTXINFO] = guc_ctl_ctxinfo_flags(guc);
== [5] <- intel_uc_init_hw (intel_uc.c:377), before any fw-status check ==
	while (attempts--) {
		/*
		 * Always reset the GuC just before (re)loading, so
		 * that the state and timing are fairly predictable
		 */
		ret = __intel_uc_reset_hw(i915);
		if (ret)
			goto err_out;

		if (USES_HUC(i915)) {
			ret = intel_huc_fw_upload(huc);
			if (ret)
				goto err_out;
		}

		intel_guc_init_params(guc);
		ret = intel_guc_fw_upload(guc);
		if (ret == 0 || ret != -EAGAIN)
== [6] <- i915_gem.c:5746 (driver load / hw init) ==

	/* We can't enable contexts until all firmware is loaded */
	ret = intel_uc_init_hw(dev_priv);
	if (ret) {
		DRM_ERROR("Enabling uc failed (%d)\n", ret);
== [7] i915_ggtt_offset derefs vma in BOTH debug and release ==
static inline u32 i915_ggtt_offset(const struct i915_vma *vma)
{
	GEM_BUG_ON(!i915_vma_is_ggtt(vma));
	GEM_BUG_ON(!vma->node.allocated);
	GEM_BUG_ON(upper_32_bits(vma->node.start));
	GEM_BUG_ON(upper_32_bits(vma->node.start + vma->node.size - 1));
	return lower_32_bits(vma->node.start);
}
-- GEM_BUG_ON compiled to no-op when !CONFIG_DRM_I915_DEBUG_GEM:
#else

#define GEM_SHOW_DEBUG() (0)
== [8] gate: enable_guc default 0 on this port ==
49:	param(int, enable_guc, 0) \
154:i915_param_named_unsafe(enable_guc, int, 0400,
155-	"Enable GuC load for GuC submission and/or HuC load. "
156-	"Required functionality can be selected using bitmask values. "
157-	"(-1=auto, 0=disable [default], 1=GuC submission, 2=HuC load)");
== USES_GUC -> intel_uc_is_using_guc ==
static inline bool intel_uc_is_using_guc(void)
{
	GEM_BUG_ON(i915_modparams.enable_guc < 0);
	return i915_modparams.enable_guc > 0;
}

static inline bool intel_uc_is_using_guc_submission(void)
{
	GEM_BUG_ON(i915_modparams.enable_guc < 0);
	return i915_modparams.enable_guc & ENABLE_GUC_SUBMISSION;
}

CHAIN CONFIRMED: enable_guc!=0 on Gen9+ => intel_uc_init_hw
=> intel_guc_init_params => guc_ctl_log_params_flags
=> intel_guc_ggtt_offset(guc, NULL) => i915_ggtt_offset(NULL) => panic.