Bug 2524448

kmscon crashes with SIGSEGV during shutdown on Raspberry Pi 4 Model B. 
The RPi4 has two DRM devices: /dev/dri/card0 (vc4, display output) and 
/dev/dri/card1 (v3d, 3D-only, no dumb buffer support). When seat_go_foreground 
calls seat_video_init for the v3d device and it fails with -EOPNOTSUPP, the error 
handling frees the kmscon_video struct and unlinks it from the seat's video list, but
 does not clear the monitor device's data pointer (uterm_monitor_set_dev_data(vid->udev, NULL)
 is missing). This leaves a dangling pointer in the uterm_monitor_dev. 
During shutdown, uterm_monitor_unref iterates all monitor devices and passes 
the dangling pointer to kmscon_seat_remove_video, which dereferences freed memory 
and crashes.

Reproducible: Always

Steps to Reproduce:
1. Boot Minimal Fedora 45 Branched 20260826.n.0 on Raspberry Pi 4 Model B
2. Run kmscon in oneshot mode so it exits after the child process finishes, e.g.:
   kmscon --vt 7 --no-issue --oneshot --login /bin/true
3. kmscon encounters /dev/dri/card1 (v3d) which lacks dumb buffer support,
   fails to init the video device (-EOPNOTSUPP), but continues on /dev/dri/card0
4. The child process exits, kmscon shuts down
5. kmscon crashes with SIGSEGV during cleanup in kmscon_seat_free

Note: Long-running kmscon instances (e.g. kmsconvt@tty1 providing login prompts)
hit the same v3d init error but do not crash because they don't go through the
shutdown/cleanup path during normal operation.

Actual Results:
kmscon on tty7 runs with --oneshot --login. It spawns the child (run-initial-setup), the child fails (SELinux denials), kmscon exits, triggering kmscon_seat_free → uterm_monitor_unref which hits the dangling pointer.

Expected Results:
kmscon on tty7 does not crash regardless on intial-setup status

Additional Information:
Version-Release number of selected component:
kmscon-10.0.2-2.fc45.aarch64

Crash stack trace:
#0  kmscon_seat_remove_video.part.0 (kmscon + 0x12470)
#1  mon_free_dev (kmscon + 0x15fbc)
#2  uterm_monitor_unref (kmscon + 0x1f544)
#3  kmscon_seat_free.part.0 (kmscon + 0x152d0)
#4  main (kmscon + 0x9fcc)

Relevant journal output:
kmscon[817]: [0000.144541] ERROR: drm_shared: Device /dev/dri/card1 doesn't support universal planes, using legacy
kmscon[817]: [0000.144591] WARNING: drm_shared: Device /dev/dri/card1 doesn't support atomic modesetting, using legacy
kmscon[817]: [0000.144626] ERROR: video_drm2d: driver does not support dumb buffers
kmscon[817]: [0000.144694] ERROR: seat: cannot create video device /dev/dri/card1 on seat seat0: -95
kmscon[817]: [0000.211832] NOTICE: terminal: Display [HDMI-A] with backend [drm2d] text renderer [bbulk] font engine [unifont]
audit[817]: ANOM_ABEND auid=0 uid=0 gid=0 ses=3 pid=817 comm="kmscon" exe="/usr/bin/kmscon" sig=11

Coredump registers at crash:
PC=0x12470 (str x0, [x1, #8] -- NULL pointer dereference, writing to address 0x8)
x0=0x0 x1=0x0 (vid->list.prev and vid->list.next, both NULL from freed memory)
x20=0xaaaaf2e85600 (dangling vid pointer, memory already freed)

Suggested fix in src/seat.c, seat_go_foreground():
Add uterm_monitor_set_dev_data(vid->udev, NULL) before free(vid)
in the seat_video_init failure handling block.