Stale pointer after kfree in drm_sysfs_connector_remove -- connector->kdev not NULLed, creating latent UAF via drm_sysfs_connector_add early-return guard

Summary

drm_sysfs_connector_remove() calls kfree(connector->kdev) at line 53 but never sets connector->kdev=NULL. drm_sysfs_connector_add() at line 35 has early-return guard if(connector->kdev) return 0. If add called after remove (register retried after failure) guard sees dangling non-NULL pointer returns 0 without allocating fresh device and all subsequent uses of connector->kdev (intel_sdvo.c:2198 sysfs_create_link intel_dp.c:5251-5253 aux.dev assignment radeon/amdgpu backlight_device_register) operate on freed memory = UAF. Error path in drm_connector_register (drm_connector.c:466-467) calls drm_sysfs_connector_remove on failure while leaving registration_state=INITIALIZING (state only set REGISTERED at line 461 after error-exit labels). If drm_connector_register subsequently re-invoked -- state machine permits INITIALIZING != REGISTERED -- drm_sysfs_connector_add hits stale non-NULL kdev returns 0 then late_register derefs freed connector->kdev. Several MST paths call drm_connector_register directly without checking return (intel_dp_mst.c:500 radeon_dp_mst.c:304 amdgpu_dm_mst_types.c:418) so failed first registration silently ignored connector remains INITIALIZING with dangling kdev. Subsequent topology change (DP hotplug hub re-enumeration) can re-trigger registration. UAF gives read/write primitive on freed kmalloc slab potentially exploitable for LPE via slab grooming.