# DF-0287 — Divide-by-zero kernel panic in mesh_airtime_calc (ni_txrate==0)

## Claim
`mesh_airtime_calc()` (`ieee80211_mesh.c:3354`) computes `nbits / rate` where
`rate = ni->ni_txrate`, with **no zero guard**. A freshly discovered mesh
neighbour has `ni_txrate == 0`. Reachable from `mesh_recv_action_meshlmetric()`
(line 2560) on a Link-Metric *request* action frame with no established-peer
requirement. A single remote action frame → divide-by-zero → kernel panic.

## Runtime status
**NOT runtime-testable** — no 802.11 hardware. The bug is **definitively
confirmed by source trace** (`VERDICT.md`): `rate = ni->ni_txrate` at line 3366
feeds `nbits / rate` at line 3383 (and `ieee80211_compute_duration(...,rate,0)`
at 3367) with no `rate == 0` check.

## Realistic impact
Remote, unauthenticated kernel panic (DoS).

## Fix
`fix.diff` adds `if (rate == 0) return IEEE80211_MESHLMETRIC_INITIALVAL;` right
after `rate = ni->ni_txrate;`. Applies + compiles (nativekernel).