From b87e7456cdbb7abdea2f360cdcba0e2a56316f3f Mon Sep 17 00:00:00 2001
From: Joshua Warren <816217+joshuaswarren@users.noreply.github.com>
Date: Mon, 12 Oct 2026 23:42:17 -0500
Subject: [PATCH] honeykrisp: accept a NULL array of transform feedback counter
 buffers

vkCmdBeginTransformFeedbackEXT and vkCmdEndTransformFeedbackEXT take
pCounterBuffers as NULL or as an array of handles. With NULL, Begin starts
every transform feedback buffer at byte offset zero. End writes nothing.
The conformance test passes NULL with a count of 1 for this case. The driver
read the first element of the NULL array and crashed.

Skip the loop over the counter buffers when the array is NULL. Begin still
zeroes the four offsets, and End still copies nothing. A call with an array,
and an array with a null handle in it, behave as before.
---
 src/asahi/vulkan/hk_cmd_draw.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/asahi/vulkan/hk_cmd_draw.c b/src/asahi/vulkan/hk_cmd_draw.c
index 5823c6575fd4..65fdef4a47bd 100644
--- a/src/asahi/vulkan/hk_cmd_draw.c
+++ b/src/asahi/vulkan/hk_cmd_draw.c
@@ -3928,7 +3928,11 @@ hk_begin_end_xfb(VkCommandBuffer commandBuffer, uint32_t firstCounterBuffer,
       }
    }
 
-   for (unsigned i = 0; i < counterBufferCount; ++i) {
+   /* pCounterBuffers may be NULL, even with a non-zero count. It then names no
+    * counter buffer: Begin starts every buffer at offset zero and End writes
+    * nothing.
+    */
+   for (unsigned i = 0; pCounterBuffers && i < counterBufferCount; ++i) {
       if (pCounterBuffers[i] == VK_NULL_HANDLE)
          continue;