In some cases, we've seen drm_hwcomposer start to try to compose frames before anything has called SetClientTarget().
This seems to be some sort of a race, which for some reason we only see with certain dummy HDMI dongles (which provide fake EDID data) which allow our lab machines to run headless. I'm still trying to understand more about why this happens only in this case.
The net of the issue is we see CreateComposition() being called, which adds the client_layer_ to the zmap. Then it creates the DrmHwcLayers copying the non-initialized buffer_ value as the sf_handle.
This then later causes a crash in ImportBuffer() when we traverse the non-null (but invalid) hnd value.
Thus, this patch simply initilizes the buffer_ pointer to NULL so that we error out properly in the case of the race.