# DF-1274 — tonga SCLK/MCLK spread-spectrum divide-by-zero (LATENT)

## Verdict
**NOT REPRODUCED on the audit guest (LATENT / HW-gated).** The bug is
**confirmed real by source-level trace**; it cannot fire here because there is
no AMD GPU, so the `dev/drm/amd/powerplay/smumgr/tonga_smumgr.c` path is dead
at runtime.

## Mechanism (confirmed in source)
- `tonga_calculate_sclk_params` (`tonga_smumgr.c:591`):
  `clkS = reference_clock * 5 / (reference_divider * ss_info.speed_spectrum_rate);`
- `tonga_calculate_mclk_params` (`tonga_smumgr.c:883`):
  `clks = reference_clock * 5 / ss_info.speed_spectrum_rate;`
- `ss_info.speed_spectrum_rate` is loaded **directly** from the VBIOS field
  `usSpreadRateInKhz` (`ppatomctrl.c:1248`,
  `ssEntry->speed_spectrum_rate = le16_to_cpu(ssInfo->usSpreadRateInKhz);`)
  with **no zero check** in `atomctrl_get_{engine,memory}_clock_spread_spectrum`.
- `reference_divider = 1 + dividers.uc_pll_ref_div` (`tonga_smumgr.c:~559`) so it
  is always ≥ 1; the sole zero divisor is `ss_info.speed_spectrum_rate`.
- A crafted VBIOS with `usSpreadRateInKhz == 0` ⇒ integer **divide-by-zero
  (#DE)** ⇒ fatal trap / kernel panic at powerplay init.
- Sibling of DF-1204 (`ni_dpm` `ss.rate`), same class, fixed the same way.

## Why it does not reproduce here
No AMD GPU on the guest; `tonga_smumgr` attaches only to Tonga/Fiji/Polaris
AMD GPUs via powerplay. Reaching the bug needs that hardware + a crafted VBIOS.
**Valid hard blocker**.

## Exploit chain
N/A — divide-by-zero DoS (panic), HW-gated (latent). No write primitive.

## PoC changes
`trigger.c` is a documentation stub.

## Fix (`fix.diff`)
Skip spread-spectrum programming when the VBIOS rate is zero, by tightening
both `if (0 == atomctrl_get_*_clock_spread_spectrum(...))` conditions to also
require `ss_info.speed_spectrum_rate != 0`. Matches the finding proposal
("check rate!=0 before division") and the DF-1204 fix pattern. Applies cleanly
(`patch -p1` rc=0).

## Fix validation
`not_testable` — code path unreachable on audit guest; diff applies cleanly,
syntactically reviewed.