# DF-1334 — VERDICT

**REPRODUCED at the function level** (impact: `dos`).

## Mechanism

rv770_dpm.c has multiple integer divides whose denominators come from VBIOS or atom-firmware calls and are not validated:
  1. rv770_populate_smc_t at :278-282: a_d = low.sclk*(100-rlp) + med.sclk*lmp, used as denominator. If VBIOS reports sclk=0 for the BOOT state (common for non-BOOT state), a_d==0 -> div0.
  2. rv770_populate_sclk_value at :548: reference_clock*5 / (reference_divider * ss.rate). If VBIOS SS rate < 100, integer truncation makes (rate/100) = 0 in the parent code path; here ss.rate itself can be 0 -> div0.
  3. rv770_construct_vddc_table at :1248: steps = (max-min)/step + 1. radeon_atom_get_voltage_step() can return -EINVAL leaving step uninitialized or 0 -> div0.

## Why not live-reproduced on the QEMU guest

AMD/ATI radeon RV770-era GPU absent from QEMU guest. The radeon module loads only on matching HW. Triggered at DPM init / VDDC-table construction time.

## Recommended fix

Add explicit guards at each sink: (a) check 'if (a_d != 0)' before dividing in rv770_populate_smc_t; (b) check 'if (reference_divider == 0 || ss.rate == 0) goto out_no_ss;' before computing clk_s, and skip the SS programming if clk_s == 0; (c) check 'if (step == 0) return -EINVAL;' before dividing in rv770_construct_vddc_table.

## Kernel references (confirmed during verification)

- sys/dev/drm/radeon/rv770_dpm.c:278-282 (a_n / a_d)
- sys/dev/drm/radeon/rv770_dpm.c:548 (clk_s with reference_divider * ss.rate)
- sys/dev/drm/radeon/rv770_dpm.c:1248 (steps = (max-min)/step + 1)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`