# DF-0382 — config_red divide-by-zero panic

## Bug
`sys/net/dummynet3/ip_dummynet3.c:1351` and `:1354`:

```c
x->c_1 = ioc_fs->max_p / (ioc_fs->max_th - ioc_fs->min_th);   /* div0 if max_th==min_th */
...
if (x->flags_fs & DN_IS_GENTLE_RED) {
    x->c_3 = (SCALE(1) - ioc_fs->max_p) / ioc_fs->max_th;      /* div0 if max_th==0 */
```

`set_fs_parms` (:1452) calls `config_red` and ignores its return ("XXX should
check errors"), so neither denominator is validated before the divides.

## Reach
`setsockopt(s, IPPROTO_IP, IP_DUMMYNET_CONFIGURE /*60*/, &ioc_pipe, sizeof ioc_pipe)`
on a raw IP socket (`socket(AF_INET, SOCK_RAW, IPPROTO_RAW)`). Handled by
`rip_ctloutput` → `ip_dn_sockopt` → `config_pipe` → `set_fs_parms` →
`config_red`. The raw IP socket requires `SYSCAP_NONET_RAW`
(`sys/netinet/raw_ip.c:rip_attach`), i.e. root or jail-root (the finding's
stated threat: jail-root can panic the host kernel).

## Build
```
cc -O2 -o df_0382_div0 df_0382_div0.c
```

## Run (as root — needs raw socket capability)
```
./df_0382_div0            # default: max_th==min_th path (line 1351)
./df_0382_div0 gentle     # GENTLE_RED path, max_th==0 (line 1354)
```

## Expected (bug present)
Kernel divide-by-zero panic — `pid 0 (setsockopt) trap 9: divide error`.
Guest dies, ssh drops, `dfbsd-qemu/boot.log` shows the panic.

## Preconditions
* `kldload dummynet3` (or build-time). On this guest the module is not
  auto-loaded; `ip_dn_sockopt` returns ENOENT/ENOEXEC until it is loaded, so
  the trigger script loads it as root before issuing the option.
* Root-equivalent credential (raw socket capability).