dp_enable_link_phy reassigns pipes to a possibly-NULL dp_clock_source and calls program_pix_clk through it unguarded — latent NULL function-pointer call on DCE112/DCE120/DCN10 whose resource constructs skip the dp_clock_source NULL check; planted NULL also dereferenced by dp_retrain_link_dp_test

Summary

dce112/dce120/dcn10 resource constructs create dp_clock_source with no NULL check (contrast dce80/100/110 which fail construction); dp_enable_link_phy then assigns it into pipes[] and calls ->funcs->program_pix_clk unguarded, and the planted NULL persists in current_state for a later unchecked deref at :309 - while the DC's own caller in dc_link_dp.c:1124 defends against exactly this NULL. OOM-grooming trigger, hardware-gated (no AMD GPU on guest). Consumer guards + three construct backfills fix.