# DF-0818 — HAMMER2 bulkfree div0 (latent) — reproduction pack

## TL;DR
- **Status:** NOT REPRODUCED (latent / defense-in-depth).
- The unguarded divide at `hammer2_bulkfree.c:727` is real source-level, but
  unreachable from any current mount path because the upstream guard at
  `hammer2_ondisk.c:292` rejects `volu_size == 0`, and any non-zero
  `volu_size < 8 MiB` fails alignment. The smallest valid `total_size` is
  8 MiB, making the divisor ≥ 838. No #DE trap can fire.
- A defense-in-depth `fix.diff` is included and was build-validated against
  the audit kernel (no functional regression).

## Files
| File | Purpose |
|------|---------|
| `poc.c`             | Unprivileged `HAMMER2IOC_BULKFREE_SCAN` ioctl exerciser (proves path is reachable for valid images; does not panic). |
| `craft_zero.py`     | Forges a CRC-valid HAMMER2 image with `volu_size = 0` (or any value) to demonstrate upstream rejection. |
| `fix.diff`          | Defense-in-depth zero-guard at `hammer2_bulkfree.c:727`. |
| `build.sh`          | `cc -o poc poc.c -I/usr/src/sys`. |
| `run.sh`            | Runs `./poc /mnt/h2/trigger` as the unprivileged user. |
| `VERDICT.md`        | Full narrative and source-level trace. |
| `build.log`         | Final `cc` output. |
| `run.log`           | PoC output on unpatched baseline kernel. |
| `run_patched.log`   | PoC output on patched `#1` kernel. |
| `fix_build.log`     | Full untrimmed patched-kernel build log. |
| `mount_reject.log`  | dmesg excerpt showing `volu_size=0` is rejected at line 292. |
| `env.txt`           | Guest uname, cc version. |
| `manifest.json`     | Machine-readable artifact catalog. |

## Reproduce (unprivileged)

```sh
./build.sh
# admin precondition: root creates, formats, mounts and chowns a HAMMER2 PFS
ssh dfbsd '/bin/sh -c "vnconfig -c vn0 /root/h2.img && \
                       mount_hammer2 /dev/vn0@DATA /mnt/h2 && \
                       chown -R maxx:maxx /mnt/h2"'
./run.sh             # exits 0; bulkfree completes; no panic on any valid image
```

## Crafting the volu_size=0 image (to demo upstream rejection)

```sh
python3 craft_zero.py /tmp/h2.img /tmp/h2_zero.img 0
scp /tmp/h2_zero.img dfbsd:/root/
ssh dfbsd 'vnconfig -c vn0 /root/h2_zero.img && mount_hammer2 /dev/vn0@DATA /mnt/h2'
# expect: mount: Invalid argument
# dmesg shows: hammer2_ondisk: /dev/vn0 has size of 0
```

## Expected behavior on the FIXED kernel
Identical to baseline: `BULKFREE_SCAN rc=0`, `sstop=<total_size>`, no panic.
The fix only changes behavior in the unreachable `total_size < 10000` case,
clamping `incr = 10000` instead of dividing by zero.