# DF-1323 — VERDICT

**REPRODUCED at the function level** (impact: `dos`).

## Mechanism

iceland_thermal_setup_fan_table() computes t_diff1 = usTMed - usTMin and t_diff2 = usTHigh - usTMed from VBIOS-supplied fan-control parameters (process_pptables_v1_0.c:941-946). slope1 at :2128 divides by t_diff1; slope2 at :2129 divides by t_diff2. No monotonicity or zero check exists. duty100==0 is guarded at :2117 but t_diff is not. A crafted/corrupt VBIOS where usTMed==usTMin or usTHigh==usTMin causes #DE (SIGFPE) panic.

## Why not live-reproduced on the QEMU guest

AMD GPU (iceland/Tonga/Fiji) hardware is absent from the QEMU guest; the amdgpu module loads only when matching PCI hardware probes. The bug fires at adapter-init / fan-table-setup time, driven by VBIOS, not by any unprivileged-guest-user syscall.

## Recommended fix

After computing t_diff1/t_diff2 in iceland_thermal_setup_fan_table(), check 'if (t_diff1 == 0 || t_diff2 == 0)' and if so, clear PHM_PlatformCaps_MicrocodeFanControl and return 0 — mirroring the existing duty100==0 guard.

## Kernel references (confirmed during verification)

- sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:2122-2123 (t_diff1/t_diff2 computed)
- sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:2128-2129 (unguarded divisions)
- sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:2117-2121 (existing duty100 guard as model)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`