# DF-1245 — Divide-by-zero DoS in evergreen_cs_track_validate_cb via CB_COLOR_PITCH

## Verdict
**SOURCE-CONFIRMED (real bug), INCONCLUSIVE at runtime** — the `radeon.ko` module is not loaded (no AMD Evergreen GPU in the QEMU guest) and is not compiled into the GENERIC kernel, so the divide-by-zero path is dormant. Fix authored and compile-validated.

## Mechanism (source trace)
The radeon DRM command-submission parser stores the raw user IB dword for `CB_COLORn_PITCH` **unmasked** into the track state, unlike the depth and texture paths which mask first:

- `sys/dev/drm/radeon/evergreen_cs.c:1396` — `track->cb_color_pitch[tmp] = radeon_get_ib_value(p, idx);` (raw 32-bit, no `& PITCH_TILE_MAX` mask).
  Compare: the depth path uses `G_028058_PITCH_TILE_MAX` (11-bit, `evergreen_cs.c:568`); the texture path uses `G_030000_PITCH` (12-bit). The CB color path has no equivalent mask.
- `sys/dev/drm/radeon/evergreen_cs.c:401-404`:
  ```
  pitch = track->cb_color_pitch[id];        /* unsigned, raw */
  slice = track->cb_color_slice[id];
  surf.nbx = (pitch + 1) * 8;
  surf.nby = ((slice + 1) * 64) / surf.nbx;   /* DIVIDE BY ZERO if nbx==0 */
  ```
- If a DRM_AUTH client submits `CB_COLORn_PITCH = 0xFFFFFFFF`, then `(pitch+1)*8 = 0` (32-bit wrap) and the division at line 404 faults with a kernel `#DE` (divide error) → panic.

## Why not reproduced at runtime
- `radeon.ko` is **not loaded** on the guest (`kldstat` shows only kernel + ehci.ko + xhci.ko) and is **not in X86_64_GENERIC** (no `device radeon` in the kernel config).
- Requires an AMD Evergreen-class (Radeon HD 5xxx/6xxx) GPU attached; the QEMU guest uses `-vga none`/stdvga, no AMD GPU.
- Requires `DRM_AUTH` (an authenticated DRM client, i.e. a local X user). This is a local DoS via GPU command submission, reachable only on systems with the affected hardware.

## Fix (fix.diff, compile-validated)
Guard `surf.nbx == 0` before the division, returning `-EINVAL` (matching the existing `dev_warn` + `return -EINVAL` pattern used elsewhere in the function). The patched `evergreen_cs.c` compiles cleanly with gcc 8.3, `-Werror`, no warnings.

## Realistic impact ceiling
Local kernel panic (DoS) by a DRM-authenticated user on a machine with an AMD Evergreen GPU. No memory-corruption primitive — purely a divide-by-zero fault. On this guest: **not reachable** (no AMD GPU).