Claude review: drm/tegra: fbdev: Use a DRM client buffer

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Status: Good**

This is the core patch. It replaces the direct `tegra_fb_alloc()` call with the standard `drm_client_buffer_create()` path, which goes through `drm_mode_addfb2()` → `tegra_fb_create()` → `tegra_fb_alloc()` internally.

**Reference counting analysis — all paths correct:**

*Success path:*
1. `tegra_bo_create` → gem ref = 1
2. `drm_gem_handle_create` → gem ref = 2
3. `drm_client_buffer_create` → `drm_gem_object_lookup` (ref = 3) + `drm_mode_addfb2` → `tegra_fb_create` → lookup (ref = 4, held by fb->obj[0])
4. `drm_gem_handle_delete` → ref = 3
5. `drm_gem_object_put(gem)` → ref = 2 (one in buffer->gem, one in fb->obj[0])

*Destroy path (`tegra_fbdev_fb_destroy`):*
- `drm_client_buffer_delete` → `drm_mode_rmfb` drops fb (ref = 1) → `drm_gem_object_put(buffer->gem)` (ref = 0) → freed. Correct.

*Error path (vmap fails):*
- `drm_client_buffer_delete` → ref goes 4→2, then `drm_gem_handle_delete` → 1, then `drm_gem_object_put` → 0. Correct.

*Error path (buffer create fails):*
- buffer_create cleans up internally, `drm_gem_handle_delete` → 1, `drm_gem_object_put` → 0. Correct.

The `drm_gem_vunmap` call inside `drm_client_buffer_delete` is a no-op here since tegra does its own vmap/vunmap and `buffer->map` remains zero-initialized from `kzalloc`. No issue.

The destroy function correctly cleans up with `drm_client_buffer_delete` instead of `drm_framebuffer_remove`:

```c
-	drm_framebuffer_remove(fb);
+	drm_client_buffer_delete(helper->buffer);
```

No issues.

---
Generated by Claude Code Patch Reviewer