--- a/sys/dev/drm/drm_blend.c
+++ b/sys/dev/drm/drm_blend.c
@@ -499,7 +499,18 @@
 		if (!crtc)
 			continue;
 		if (old_plane_state->zpos != new_plane_state->zpos) {
+			/*
+			 * A plane whose zpos changed can be part of this
+			 * transaction while its (unchanged) CRTC is not;
+			 * drm_atomic_get_new_crtc_state() then returns NULL
+			 * and writing zpos_changed through it is a NULL
+			 * deref (panic from DRM_IOCTL_MODE_ATOMIC /
+			 * DRM_IOCTL_MODE_OBJ_SETPROPERTY on any driver
+			 * that sets mode_config.normalize_zpos).
+			 */
 			new_crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
+			if (!new_crtc_state)
+				return -EINVAL;
 			new_crtc_state->zpos_changed = true;
 		}
 	}