=== DF-0794: divide-by-zero in ffs_dirpref when fs_ncg==0 ===
uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

--- creating 4 MB image ---
[newfs] /dev/vn0: media size   4.00MB
[newfs] Warning: Block size restricts cylinders per group to 107.
[newfs] /dev/vn0:	8192 sectors in 2 cylinders of 1 tracks, 4096 sectors
[newfs] 	4.0MB in 1 cyl groups (107 c/g, 214.00MB/g, 512 i/g)
[newfs] super-block backups (for fsck -b #) at:
[newfs]  32

--- patching superblock (fs_ncg=0) ---
BEFORE: magic=0x00011954 ncg=1 bsize=16384 sbsize=2048 cssize=2048 cstotal.cs_nifree=509 clean=1 postblformat=1 contigsumsize=7
AFTER : magic=0x00011954 ncg=0 bsize=16384 sbsize=2048 cssize=2048 cstotal.cs_nifree=1 clean=1 postblformat=1 contigsumsize=7
patched /tmp/df0794.img: fs_ncg=0, fs_cstotal.cs_nifree=1, fs_clean=1

--- attaching + mounting RW ---
mount: warning: fstype in disklabel not set to anything I understand
attempting to mount with -t ufs
mount OK; mount output:
/dev/vn0 on /tmp/df0794_mnt (ufs, local)

--- triggering mkdir (should panic the kernel #DE) ---
if this returns, the bug is fixed; if ssh dies, the kernel panicked.
*** ssh session terminated by remote (kernel panicked) ***
*** serial console (boot.log) recorded: ***

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 3; lapic id = 3
instruction pointer	= 0x8:0xffffffff80905894
stack pointer	        = 0x10:0xfffff8011825f3e8
frame pointer	        = 0x10:0xfffff8011825f458
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1045
current thread          = pri 6
kernel: type 18 trap, code=0

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      ffs_valloc+0x194:       idivl   %ecx,%eax
db>

=== INTERPRETATION ===
Trap 18 == x86 #DE (divide error). The faulting instruction
`idivl %ecx,%eax` is the inlined ffs_dirpref division
`avgifree = fs->fs_cstotal.cs_nifree / fs->fs_ncg` (ffs_alloc.c:676)
where fs_ncg==0. ffs_dirpref was inlined into its sole caller ffs_valloc
(both static), so the symbol in the panic is ffs_valloc. Bug REPRODUCED.