DF-1279 / trigger_analysis.c
/* * DF-1279 trigger analysis — INCONCLUSIVE (no MPT HW in guest). * * The bug is a divide-by-zero (kernel #DE panic) caused by an IOCFACTS reply * reporting RequestFrameSize == 0 from an LSI MPT/Fusion HBA. The * divide-by-zero is in the MPT_NRFM(mpt) macro (mpt.h:882), evaluated at * mpt.c:2683 inside mpt_configure_ioc() at attach time. * * Reproduction requires a malicious or buggy MPT/Fusion HBA whose IOCFACTS * reply has RequestFrameSize == 0; no MPT PCI device exists in this QEMU * guest, so the path is never executed. Source-level proof in VERDICT.md. * * Build: N/A (analysis-only). * Run : N/A. */ int df1279_trigger_marker = 0; |