# DF-1017 — READ_CAPACITY block_len=0 divide-by-zero

## Build
```
./build.sh
```
(or: `cc -o harness harness.c`)

## Run
```
./run.sh
```
(or: `./harness`)

## Expected output
The harness demonstrates that `secsize=0` (from a malicious READ_CAPACITY
response) causes division-by-zero at 7 kernel sites in `dastart()`/`dadump()`.
The kernel would panic with a fatal #DE trap.

## Preconditions (for runtime trigger)
- A SCSI Direct Access (`da`) device returning READ_CAPACITY with `length=0`.
- This QEMU guest has NO `da` device (only a DVD-ROM) — source-level only.

## Fix
`fix.diff` — validate `block_len` in `dasetgeom()`: reject 0 and out-of-range
values, falling back to 512.