# DF-0334 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: in_pcbbind_remote computes count=last-first then karc4random()%count (line 885), and in_pcbsetlport does cut%lport where lport=last-first; if the sysctl range collapses to first==last, count=0 -> divide-by-zero panic. Root sets the degenerate range; an unpriv connect()/bind() triggers.

## Impact ceiling
panic

## Cited refs
- sys/netinet/in_pcb.c:884
- sys/netinet/in_pcb.c:414

## Fix
Return EADDRNOTAVAIL when the local-port range collapses (count==0) before the modulo.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.