mst_primary NULL dereference race in drm_dp_mst_handle_up_req (send_up_ack_reply without lock or NULL check)

Summary

handle_up_req calls drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, ...) reading mgr->mst_primary without mgr->lock; topology_mgr_set_mst(false) NULLs it under the lock during unplug. A CONNECTION_STATUS/RESOURCE_STATUS notify racing MST teardown passes NULL as txmsg->dst, and set_hdr_from_dst_qlock dereferences mstb->lct/tx_slots at NULL+offset -> kernel panic. Compare drm_dp_get_mst_branch_device which does check. Malicious hub or unplug timing: NULL-deref panic. Lock+kref+NULL-check fix.