Claude review: rust: drm: fix unsound initialization in drm::Device::new

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Bug analysis — confirmed correct:**

The current code path on init failure is:
1. `data.__pinned_init(raw_data)` fails
2. `inspect_err` calls `drm_dev_put(drm_dev)`
3. Refcount → 0, triggers `drm_dev_release()` in C
4. `drm_dev_release()` checks `dev->driver->release` — it's `Some(Self::release)`
5. `Self::release()` calls `drop_in_place(this)`, dropping uninitialized `T::Data` — **UB**

**Fix analysis:**

The temporary stack-allocated vtable is correct:

```c
let alloc_vtable = bindings::drm_driver {
    release: None,
    ..Self::VTABLE
};
```

The lifetime is sound: `alloc_vtable` lives on the stack for the entire function body. It is only accessed through `drm_device->driver` in two places: (1) within `__drm_dev_alloc` → `drm_dev_init`, and (2) in the error path via `drm_dev_put` → `drm_dev_release`. In both cases `alloc_vtable` is still in scope. On error, `drm_dev_put` frees the device, so no dangling reference survives. On success, the driver pointer is replaced before the function returns.

The `const { &Self::VTABLE }` trick for installing the real vtable is correct and idiomatic:

```rust
unsafe { (*drm_dev).driver = const { &Self::VTABLE } };
```

The `const { ... }` block promotes the reference to `'static`, matching the original guarantee that the vtable pointer stored in the `drm_device` outlives the device. The SAFETY justification ("drm_dev is still private to this function") is correct — the device hasn't been returned or registered, so mutation is safe.

Moving `into_drm_device` before the init attempt is harmless (pure pointer arithmetic, no side effects) and avoids duplication between the error and success paths.

**Minor nit — SAFETY comment could be more precise:**

```rust
// - `alloc_vtable` reference remains valid until no longer used,
```

This is somewhat tautological. Consider something like:
```
// - `alloc_vtable` is stack-allocated and outlives all accesses: it is either
//   replaced by a static ref on success or the device is freed on failure,
```

Not a blocker — the code is correct regardless.

**Pre-existing typo (not introduced by this patch):** the SAFETY comment has `invarants` instead of `invariants`.

**Verdict: Looks good.** The fix is minimal, addresses a real soundness issue, and the lifetime reasoning is sound.

---
Generated by Claude Code Patch Reviewer