DF-3948 — dce110_enable_per_frame_crtc_position_reset(): unguarded NULL event_source deref (currently dead path)

Severity: Info (latent; dead API today — same family as DF-3944/DF-1300) CWE-476

Bug

sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2320:

    gsl_params.gsl_master = grouped_pipes[0]->stream->triggered_crtc_reset.
        event_source->status.primary_otg_inst;

event_source is dereferenced with no NULL check. The producer-side scaffolding is already wired and can assign NULL: amdgpu_dm.c:2816-2833 set_master_stream() does stream_set[j]->triggered_crtc_reset.event_source = stream_set[master_stream]; where master_stream starts at 0 — if stream_set[0] is NULL (slot holes are possible: the loop skips NULL entries), every stream gets event_source == NULL. The only gate is dc.c:786-799 enable_timing_multisync(), which selects pipes whose triggered_crtc_reset.enabled is true — and grep-verified no code in this tree ever sets .enabled = true (rg 'triggered_crtc_reset.enabled *=' returns nothing; the amdgpu_dm TODO at :2845 says the VSDB parser that would set it is unimplemented). dcn10_hw_sequencer.c:1406 has the identical unguarded pattern.

So today the path is unreachable (dead), but it is one unfinished feature away from a NULL-deref panic reachable by dc_commit_state (dc.c:979). Filed as Info hardening: add the NULL check now (or assert both).

Fix

-   gsl_params.gsl_master = grouped_pipes[0]->stream->triggered_crtc_reset.event_source->status.primary_otg_inst;
+   if (!grouped_pipes[0]->stream->triggered_crtc_reset.event_source)
+       return;
+   gsl_params.gsl_master = ...same...;

Verification: untested (Info, dead path, hardware-gated); source-certain.

DF-3948 — Verification Verdict

Status: untested (Info dead-path finding; verification skipped — unreachable today) Impact: none (latent NULL-deref panic if the multisync feature is finished) Confidence: certain (source)

Dead-path proof: rg 'triggered_crtc_reset' over sys/dev/drm shows — * reader/guard: core/dc.c:793-796 (stream->triggered_crtc_reset.enabled) * scaffolding writer: amdgpu_dm.c:2831 (event_source = stream_set[master_stream], can be NULL when stream_set[0]==NULL) * no assignment of .enabled = true anywhere → enable_timing_multisync (dc.c:784-806) never populates multisync_pipes[] → dce110_enable_per_frame_crtc_position_reset (dce110_hw_sequencer.c:2310) is never called. Identical latent pattern at dcn10_hw_sequencer.c:1406.

Same treatment as DF-3944/DF-1300 (dead-API hardening). fix.diff adds the NULL guard. No runtime test possible/needed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.