# DF-0999 — rum_set_sleep_time divide-by-zero

## Summary
`rum_set_sleep_time()` at `sys/bus/u4b/wlan/if_rum.c:2671` divides
`ic->ic_lintval / bintval` where `bintval` ultimately comes from the
beacon IE. `net80211` does flag bintval=0 as `IEEE80211_BPARSE_BINTVAL_INVALID`
but **never enforces** the flag, so the zero reaches the divide → #DE →
kernel panic.

Trigger: malicious AP within radio range broadcasting beacon_int=0; victim
STA associates → RUN state → `rum_enable_tsf_sync` → `rum_set_sleep_time(0)`.

## Why not tested on default guest
No RT2573 USB WiFi adapter and no malicious AP in the QEMU guest.

## Fix
`fix.diff` guards `bintval == 0` (treat as 1) at the top of
`rum_set_sleep_time()`.

## Compilation check
Compiles cleanly into `if_rum.ko` (see `module_build.log`).