# DF-0910 — Divide-by-zero via HAMMER_IOC_PRUNE mod_tid=0

**Verdict**: REPRODUCED → fix VALIDATED.  
**Impact**: panic (privileged-user DoS; root-only ioctl, no escalation).  
**Severity**: Medium.

## Bug
`sys/vfs/hammer/hammer_prune.c:305-306` divides by `scan->mod_tid` (uint64,
user-supplied via `copyin` at `:104`) with no zero-check. An ioctl with
`mod_tid=0` and a deleted B-tree record in range drives a CPU #DE → kernel
panic.

## Reproduce
```sh
./build.sh                    # cc -o prune_div0 prune_div0.c
./run.sh                      # root: sets up HAMMER v1 mount, fires ioctl
```
- **Vulnerable kernel**: `Fatal trap 18: integer divide fault` at
  `hammer_ioc_prune+0x31b: divq %r9,%eax` → DDB.
- **Fixed kernel**: ioctl returns `EINVAL` (errno 22), guest stays up.

## Fix
`fix.diff` rejects `mod_tid==0` (EINVAL) right after the element `copyin`.
Validated on a single-fix kernel (`6.5-DEVELOPMENT #1`).

## Files
See `manifest.json`.