# DF-5144 — Latent unchecked deref + lockless state walk in dead public API `dc_plane_get_status()`

File: `sys/dev/drm/amd/display/dc/core/dc_surface.c:98-129`
Severity: **Info** (hardening / defense-in-depth — no demonstrated impact in this tree)
Status: **Phase V skipped per contract** (Info severity; no PoC built, no guest run).

## What this is

A pass-2 (GLM 5.3) finding on `dc_surface.c`. Three latent defects in the public DC
API `dc_plane_get_status()`, which currently has **zero callers anywhere in `sys/`**
(declared at `sys/dev/drm/amd/display/dc/dc.h:563`, defined at `dc_surface.c:98`,
never called — `amdgpu_dm.c` in this tree does not invoke it):

1. `dc_surface.c:118` — `core_dc->res_pool->pipe_count` is dereferenced with no
   NULL check on `core_dc->res_pool`. The function carefully checks
   `plane_state`, `plane_state->ctx`, `plane_state->ctx->dc` (:105-107) and
   `core_dc->current_state` (:115) but omits `res_pool`.
2. `dc_surface.c:118-126` — the loop walks `core_dc->current_state->res_ctx.pipe_ctx[]`
   with **no reference and no lock**. `dc->current_state` is swapped and the old
   state freed in the commit path (`sys/dev/drm/amd/display/dc/core/dc.c:1026-1030`,
   `:1649-1650`) with no internal DC lock; safety depends entirely on callers
   serializing against commits. A caller that does not hold the modeset locks
   races a UAF read.
3. `dc_surface.c:125` — `core_dc->hwss.update_pending_status(pipe_ctx)` is invoked
   without a NULL check. Today every hw sequencer populates it
   (`dce110_hw_sequencer.c:2883`, `dcn10_hw_sequencer.c:2719`; dce80 delegates to
   the dce110 table at `dce80_hw_sequencer.c:77`), so this is only a robustness gap.

## Why no PoC

Info severity → Phase V is skipped per the reviewer contract ("Skip … for Low/Info
hardening findings"). The function is unreachable in the shipped tree, so there is
no trigger to build: no userspace path reaches `dc_plane_get_status()`.

## Reproduce the *analysis* (static)

```
rg -n "dc_plane_get_status" sys/          # only dc.h declaration + dc_surface.c definition
sed -n '98,129p' sys/dev/drm/amd/display/dc/core/dc_surface.c
sed -n '1020,1035p' sys/dev/drm/amd/display/dc/core/dc.c   # lockless current_state swap/free
```

## Recommended fix

Take a state reference, check `res_pool`, see `VERDICT.md` for the diff.