request_irq admits duplicate (irq,dev_id) registration and its failure path releases/NULLs pdev-global IRQ state owned by live registrations — armed handler left on released resource/MSI vectors (interrupt-time UAF), orphaned handler with dangling dev_id, NULL-resource crash on retry, double-release at teardown

Summary

No duplicate admission control + the error path destroys pdev-global state owned by the winner (resource, MSI vectors, _irqr=NULL): a racing drm_irq_install (the DF-5101 install-side window) turns a failed duplicate into destruction of the live registration's plumbing, or a successful duplicate into an orphaned armed handler after single uninstall - interrupt-context UAF/cross-device type confusion shape. Root/driver-context gated. Reject-duplicates + release-nothing-on-fail fix (composes with the DF-5101 lock fix).