DF-4033 evidence pack

Connector property handlers and radeon_get_monitor_bpc dereference radeon_encoder without a NULL check after best_encoder() (radeon_connectors.c:733/737, :753, :972/975, :161-165). radeon_dvi_encoder

Build

./build.sh   (cc -O2 -Wall; verified on the DragonFly audit guest — build.log)

Run

./run.sh     (verified on the DragonFly audit guest — run.log; triggers exit 2:
             /dev/dri absent — no radeon GPU on the QEMU guest, see env.txt)

Expected on r600/rv770 hardware

See VERDICT.md.

DF-4033 — NULL radeon_encoder dereference family in connector property handlers and monitor-bpc path

File: sys/dev/drm/radeon/radeon_connectors.c Severity: Low (local DoS panic; DRM_MASTER-gated for the property paths, misconfiguration-gated) Class: CWE-476 NULL pointer dereference.

Root cause (path:line)

Three property handlers and one bpc helper obtain the encoder via connector_funcs->best_encoder(connector) (when connector->encoder == NULL) and then dereference the result without a NULL check:

• radeon_connector_set_property() scaling-mode block — deref at radeon_connectors.c:733 (radeon_encoder->rmx_type) and :737 (->native_mode.clock); encoder from :719-724.
• radeon_connector_set_property() output-csc block — deref at radeon_connectors.c:753 (radeon_encoder->output_csc); encoder from :746-751.
• radeon_lvds_set_property() — deref at radeon_connectors.c:972/:975; encoder from :958-963.
• radeon_get_monitor_bpc() LVDS/eDP branch — deref at radeon_connectors.c:163-165 (dig = radeon_encoder->enc_priv; dig->lcd_misc); encoder from :161 (radeon_best_single_encoder returns NULL on an empty possible-encoder list).

best_encoder is radeon_dvi_encoder for DVI/DP connectors (radeon_connectors.c:1453-1478), which returns NULL when the connector's possible-encoder list is empty (all three loops fall through to return NULL at :1477), and radeon_best_single_encoder (:379-389) returns NULL in the same situation. Empty possible-encoder lists occur on connector-table/BIOS misconfigurations and on partially failed connector bring-up (the same class of misconfiguration that DF-1343/DF-1344 depend on).

Reachability: DRM_IOCTL_MODE_SETPROPERTY/MODE_OBJ_SETPROPERTY are DRM_MASTER (sys/dev/drm/drm_ioctl.c:667,679) — i.e. the X server/compositor or any process that acquires master on an unclaimed device; the bpc path is reached from modesets (atombios_crtc.c:987, atombios_dp.c:310, evergreen.c:1290, r600.c:299, rs600.c:164, cik.c:8770). Impact: kernel NULL-deref panic (local DoS).

Upstream status

Upstream Linux master has the identical missing guards (verified against the master file: no if (!radeon_encoder) after any of the four sites). Unfixed upstream.

Verification (this pack)

• conn_probe.c mode setprop — raw DRM_IOCTL_MODE_OBJ_SETPROPERTY probe of the connector-property surface (builds clean on the guest; run.log).
• Runtime hardware-gated (no radeon GPU on the audit guest — env.txt); the dereference itself is source-certain given an empty possible-encoder list.

Suggested fix

fix.diff: NULL-check radeon_encoder (three property sites) and NULL-check encoder/enc_priv in radeon_get_monitor_bpc.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.