DragonFlyBSD Kernel Audit
DF-1048 / run.log
← back to finding ↓ download raw
$ ./harness_O0
DF-1048 harness: umcs7840_calc_baudrate divide-by-zero proof
array umcs7840_baudrate_divisors has 9 elements (len-1 = 8)
On x86-64, integer /0 raises #DE -> kernel panic (trap 17); userspace analog is SIGFPE.

== BUGGY version (mirrors umcs.c:1056-1070 as shipped) ==
  rate=0          -> *** DIVIDE BY ZERO (SIGFPE / #DE trap) ***
  rate=115200     -> returned rc=0 divisor=0x0001 clk=0x00
  rate=921600     -> returned rc=0 divisor=0x0001 clk=0x50

== FIXED version (mirrors fix.diff: rate==0 guard) ==
  rate=0          -> returned rc=-1 divisor=0xdead clk=0xff
  rate=115200     -> returned rc=0 divisor=0x0001 clk=0x00
  rate=921600     -> returned rc=0 divisor=0x0001 clk=0x50

CONCLUSION: buggy version faults on rate==0 (kernel #DE panic, trap 17);
            fixed version returns -1 cleanly (-> EINVAL propagates to tcsetattr).
RUN_EXIT_O0=0

$ ./harness_O2
DF-1048 harness: umcs7840_calc_baudrate divide-by-zero proof
array umcs7840_baudrate_divisors has 9 elements (len-1 = 8)
On x86-64, integer /0 raises #DE -> kernel panic (trap 17); userspace analog is SIGFPE.

== BUGGY version (mirrors umcs.c:1056-1070 as shipped) ==
  rate=0          -> *** DIVIDE BY ZERO (SIGFPE / #DE trap) ***
  rate=115200     -> returned rc=0 divisor=0x0001 clk=0x00
  rate=921600     -> returned rc=0 divisor=0x0001 clk=0x50

== FIXED version (mirrors fix.diff: rate==0 guard) ==
  rate=0          -> returned rc=-1 divisor=0xdead clk=0xff
  rate=115200     -> returned rc=0 divisor=0x0001 clk=0x00
  rate=921600     -> returned rc=0 divisor=0x0001 clk=0x50

CONCLUSION: buggy version faults on rate==0 (kernel #DE panic, trap 17);
            fixed version returns -1 cleanly (-> EINVAL propagates to tcsetattr).
RUN_EXIT_O2=0

$ ./raw_div0  # raw integer divide-by-zero, no handler
RAW_EXIT=136  (136 = 128+8 = SIGFPE = #DE trap)

$ ./trigger /dev/cuaU0  # live path (expected ENOENT: no USB HW)
Floating point exception (core dumped)
/dev/cuaU0: No such file or directory
TRIGGER_EXIT=1