# DF-5783 — legacy cursor update corrupts live crtc->state->active_planes on failure (missing upstream c249c5f64336)

## Build / Run / Expected (on i915 hardware, as DRM master)
```
cc -O2 -o /tmp/cursor_active_planes_race cursor_active_planes_race.c
/tmp/cursor_active_planes_race     # card/driver discovery; race sequence in header
```
Vulnerable driver: cursor-off fast-path update aborted by a signal after the
check phase leaves `crtc->state->active_planes` without PLANE_CURSOR while
the hardware cursor is still on; the next modeset-disable misses the cursor
plane (underruns / dead pipe). Fixed driver (v5.0+ c249c5f64336): mutation
happens on a duplicated state and only `active_planes` is copied back on
success.

## On this audit rig
Bochs VGA only (no i915) — program exits at driver discovery. Verification
is static + upstream differential (VERDICT.md).

## Contents
cursor_active_planes_race.c, VERDICT.md, fix.diff (backport), verdict.json,
manifest.json, env.txt