xf86CrtcRotate() is called by randr 1.2 drivers via xf86CrtcSetMode() or xf86SetDesiredModes() during ScreenInit() at which point pScrn->pScreen is not set. If a user specifies a rotation in their config file pScrn->pScreen is dereferenced and boom.