and now understand the perm problem; I was running X :2 from vt 2, it was starting X visible on vt 3, when I changed to vt3 it removed the acl on /dev/dri/card0 so that it lost the perms when clients ran (although the server still had it open). So still say it's missing that NULL check.