# DF-5078 — DCE120 irq table VLINE0 gap → NULL `.funcs` dispatch

**File:** `sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:177-263`
(DF-2168/DF-4713/DF-4932/DF-4995/DF-5054 family instance on the DCE120 table —
the shape noted for maintainers in DF-4932's verdict)

## Build (on the guest)

```
mkdir -p /root/df5078 && cp dce120_vline0gap.c build.sh run.sh /root/df5078/
sh /root/df5078/build.sh
```

## Run (on the guest; run twice for determinism)

```
sh /root/df5078/run.sh     # -> run.log, run.2.log
```

## Expected

* **baseline** (`dce120_vline0gap_base`):
  * static audit: exactly **6 NULL-funcs slots — 84..89**
    (`DC_IRQ_SOURCE_DC{1..6}_VLINE0`, enum 84..89 < `DAL_IRQ_SOURCES_NUMBER`=90,
    irq_types.h:140-148);
  * controls pass: ack(90) rejected; set(PFLIP1) generic; dce120 hpd_ack
    polarity toggle; VBLANK1..6 through the real conversion path arm pipes
    0..5; to_dal sweep (256 src x 13 ext) returns **0** results in 84..89;
  * trigger: `dal_irq_service_ack(DC_IRQ_SOURCE_DC1_VLINE0)` → child dies
    **signal 11** at the `info->funcs->ack` deref (irq_service.c:152);
    `dal_irq_service_set(...)` in the main process → **SIGSEGV exit 139**
    (:116 acks first → same deref). Kernel-equivalent: page-0 read ⇒ panic.
* **fixed** (`-DFIX_DF5078`, = fix.diff): 0 NULL-funcs slots, dummy
  handlers log-and-return, **exit 0**.

Observed (guest, cc 8.3): baseline `exit=139` x2 (child signal 11 + main
fault), fixed `exit=0` x2. Kernel console corroborates the faults
(dmesg.txt: `pid ... (dce120_vline0gap) ... exited on signal 11`).

Fix validation: both dce120 fix.diffs (DF-5078 + DF-5079) applied to guest
/usr/src, full `make -j6` amdgpu.ko module rebuild **rc=0, 0 errors / 0
warnings under -Werror** (`amdgpu_module_build.log`, 777 lines;
irq_service_dce110.c + irq_service_dce120.c both recompiled at :571-574);
sources reverted md5-verified pristine; `make clean`.

Reachability is latent (traced in VERDICT.md) and the guest has no AMD GPU —
family-standard logic-level replica methodology (same as DF-4932/DF-4995/DF-5054).