{"finding_id":"DF-4770","status":"untested","attempts":0,"reproduced":0,"impact":"panic","confidence":"likely","verdict":"Latent NULL-deref, hardware-gated: intel_dp_mst_atomic_check derefs drm_atomic_get_new_crtc_state() result for connector-only transactions (same-value CRTC_ID set on an enabled MST connector returns NULL). Today every reachable transaction shape NULL-crashes earlier in the drm core (drm_atomic_uapi.c:307-316 / drm_atomic_helper.c:223-227 - cross-file lead logged for those sinks), masking this driver-side deref; it becomes a live unpriv-master panic the moment the core bugs are fixed. No i915+MST hardware on the QEMU guest. NULL-guard fix authored.","exploit_chain":"DRM master atomic commit {CONNECTOR:mst, CRTC_ID:current} on enabled MST connector -> connector-only state with zero CRTC states -> get_new_crtc_state NULL -> to_intel_crtc_state(NULL)->dp_m_n.tu read at NULL+offset","evidence":"findings/poc/DF-4770/ (this verdict; source trace in batch record)","kernel_refs":["sys/dev/drm/i915/intel_dp_mst.c:123","sys/dev/drm/i915/intel_dp_mst.c:124","sys/dev/drm/drm_atomic_uapi.c:301-316","sys/dev/drm/drm_atomic_helper.c:223-227"],"guest_uname":"","code_hash":""}