# DF-4839 — BUG_ON panic in drm_primary_helper_update on enabled connector-less CRTC

- **File:** sys/dev/drm/drm_plane_helper.c:265
- **Severity:** Info (hardening) — **Confidence:** speculative
- **Class:** kernel panic / DoS via BUG_ON (CWE-617 reachable assert)
- **Reach:** unprivileged DRM master on radeon/amdgpu/dce (drm_crtc_init users)
  via DRM_IOCTL_MODE_SETPLANE, *provided* the CRTC was left enabled with zero
  encoder-bound connectors (e.g. after a failed legacy modeset — the DF-4469
  family documents how the fail path corrupts connector->encoder bindings).

## Build / Run

No PoC exists: the audit guest has **no DRM device** (QEMU std-VGA only;
`/dev/dri*` and `/dev/drm*` do not exist), so DRM_IOCTL_MODE_SETPLANE is not
issuable. Verification was static-only; see VERDICT.md for the full
line-cited trace. On hardware the trigger would be:

```c
/* drm master fd; primary plane id P of an enabled-but-connectorless CRTC */
struct drm_mode_set_plane req = { .plane_id = P, .fb_id = F, .crtc_id = C,
    .crtc_x=0,.crtc_y=0,.crtc_w=w,.crtc_h=h,
    .src_x=0,.src_y=0,.src_w=w<<16,.src_h=h<<16 };
ioctl(fd, DRM_IOCTL_MODE_SETPLANE, &req);   /* -> BUG_ON -> panic */
```

Expected on vulnerable setup: kernel panic "kernel: BUG_ON ... num_connectors".
Expected with fix.diff: clean `-EINVAL`.

## Fix

`fix.diff` — replace BUG_ON with an error return (upstream-equivalent
hardening).