Sorry, the cover letter still had the placeholder text. The summary is: MST hotplug and topology teardown can run while the CRTCs are still enabled. That oopses in two amdgpu paths, and a third path turns the link off during detection.
HPD detect of an MST daisy-chain reaches dc_stream_get_status() from link_set_all_streams_dpms_off_for_link() with a NULL stream. The helpers load stream->ctx with no NULL check. Return NULL when stream is NULL, and skip a NULL entry in the DPMS-off loop. verify_link_capability() DPMS-offs every live stream unless the link is embedded, training is skipped, or dpcd_caps.is_mst_capable is set. detect_link_and_local_sink() re-reads DPCD first and can clear is_mst_capable while the CRTCs are still on, so detect takes the destructive path before MST rediscovery. Keep the non-destructive verify while the link still has DPMS-on master pipes. dm_dp_mst_atomic_check() calls drm_dp_atomic_release_time_slots() after an MST topology restart has cleared mst_root or the output port connector. That is the amdgpu side of a NULL deref in the helper during kwin_wayland atomic check. Call the helper only while mst_root, the port, and port->connector are still present. The matching drm_dp_mst helper fix is sent separately to dri-devel. Reproduced on a Raphael iGPU (Ryzen 9 9950X) with a USB-C to DisplayPort MST daisy-chain.
