Summary

dal_irq_service_set (irq_service.c:118 if(info->funcs->set)) and dal_irq_service_ack (:152 if(info->funcs->ack)) deref info->funcs unconditionally. find_irq_source_info (:78-86) validates array index range (source>=DAL_IRQ_SOURCES_NUMBER || source<DC_IRQ_SOURCE_INVALID) but NOT whether slot populated. All 4 per-ASIC irq_source_info tables (irq_service_dce110.c:226-313 dce80.c:189-274 dce120.c:178-262 dcn10.c:246-331) intentionally leave DC_IRQ_SOURCE_DC1_VLINE0..DC6_VLINE0 (irq_types.h:140-145) zero-initialized so funcs=NULL for those. dal_irq_service_set also unconditionally calls dal_irq_service_ack first (:116) so even source whose .set intended skip trips .ack NULL deref. Currently no in-tree caller produces VLINE0 value (grep VLINE0 only in irq_types.h never produced by to_dal_irq_source nor dm_irq_state callers). Latent panic trigger activates on future change mapping hardware src_id to VLINE0 or hardware quirk producing unmapped src_id/ext_id. Impact DoS NULL-deref panic no control-flow hijack (genuinely NULL address 0 not attacker-influenced). Attacker: local /dev/dri/cardN or malicious AMD GPU.