# DF-5054 — irq_service_dce80[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL — DF-2168/DF-4932/DF-4995 family on the DCE80 (Sea Islands) table

## What

`irq_source_info_dce80[DAL_IRQ_SOURCES_NUMBER=90]`
(`sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:188-274`) has
designators covering exactly indices 0..83 (last:
`vblank_int_entry(5)` == DC_IRQ_SOURCE_VBLANK6 == 83). The shared enum
(`irq_types.h:140-147`) continues with
DC_IRQ_SOURCE_DC1_VLINE0..DC6_VLINE0 = 84..89 — those six slots stay
zero-initialized, i.e. `.funcs == NULL`. `find_irq_source_info`
(`irq_service.c:82`) bounds-checks only the index, and
`dal_irq_service_set`/`dal_irq_service_ack` dereference
`info->funcs->set`/`->ack` unguarded (irq_service.c:118/:152) — a
set/ack of any VLINE0 source faults reading NULL+offsetof. Hub finding:
DF-2168; family: DF-4932 (dce110), DF-4995 (dcn10).

## Reproduce (on the QEMU guest; no AMD GPU needed — verbatim userland replica)

```
# build:  sh build.sh    # cc -O2 -Wall -std=gnu11 [-DFIX_DF5054]
# run:    sh run.sh      # baseline then fixed
```

The replica carries the enum, structs, the dce80 entry macros (including
the dce80-specific `[DC_IRQ_SOURCE_INVALID + reg_num]` /
`[DC_IRQ_SOURCE_HPD6 + reg_num]` designator forms), the table body,
`to_dal_irq_source_dce110` (the converter dce80 installs, dce80:277,
with the real VISLANDS30 constants), and the irq_service.c dispatch —
verbatim. Register addresses/masks are stubbed inert data.

## Expected output

Baseline (run.log / run.2.log): `table[84..89] (.funcs == NULL)` x6,
controls pass (OOB index 90 rejected; PFLIP1 generic set programs its
enable reg; dce80 hpd_ack toggles polarity; 256x13 to_dal sweep: 0
VLINE0 returns → latent), then
`dal_irq_service_set(DC_IRQ_SOURCE_DC1_VLINE0)` → **SIGSEGV exit 139**
at the `info->funcs->ack` deref. Deterministic x2.

Fixed (`-DFIX_DF5054`): 0 NULL-funcs entries, dummy handlers log and
return, exit 0. Also validated by a full `-Werror` `amdgpu.ko` module
rebuild with fix.diff applied (RC=0, irq_service_dce80.o linked,
amdgpu_module_build.log), then sources reverted md5-verified.

## Severity rationale

Low (family rating): kernel NULL-deref panic, latent — no in-tree caller
passes a VLINE0 source (traced: suspend/resume touch HPD/HPDRX only
(amdgpu_dm_irq.c:353/380/406), vblank enable is IRQ_TYPE_VBLANK+otg_inst
(amdgpu_dm.c:3014-3015), pflip is IRQ_TYPE_PFLIP (amdgpu_dm_irq.c:570),
and the IH path converts through to_dal_irq_source_dce110 which can
never return 84..89 — proven by the replica's full src-id sweep). Guest
has no AMD GPU. One future caller away from a remote-ish panic on
DCE80-era ASICs (Oland/Bonaire/Hawaii/Kabini).