The vkms_frame_info structure is allocated separately in vkms_plane_duplicate_state() and freed in vkms_plane_destroy_state(), but has the exact same lifetime as the vkms_plane_state that contains it. This separate allocation is fragile: frame_info is only allocated in duplicate_state, so any other path that creates a vkms_plane_state produces a state with a NULL frame_info pointer. Both vkms_plane_atomic_update() and vkms_plane_destroy_state() dereference it unconditionally when a CRTC is set. Embed frame_info directly in vkms_plane_state. The structure is zero-initialized as part of the kzalloc, removing the need for a separate allocation and its error handling in duplicate_state, and the matching kfree in destroy_state. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260908-drm-no-more-plane-reset-v4-2-a31b3fcfc989@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>