Thanks for the review. Both points look right to me: the self refresh exit path in dpu_crtc_disable() returns early without drm_crtc_vblank_off(), and with vblank_disable_immediate the vblank worker can end up touching DPU interrupt registers after the last runtime PM reference is gone.
Please consider this patch withdrawn. I will look at keeping the vblank IRQ path consistent with the self refresh entry/exit (and the runtime PM reference) and send a v2 if I get it right. Thanks, Ramón
