# DF-1345 — VERDICT

**REPRODUCED at the function level** (impact: `dos`).

## Mechanism

Identical to DF-1323/1325 but in polaris10_smumgr.c. polaris10_thermal_setup_fan_table() computes t_diff1/t_diff2 at :2048-2051 and divides at :2058-2059 without zero check.

## Why not live-reproduced on the QEMU guest

AMD Polaris10 GPU absent from QEMU guest; module loads only on matching HW. Triggered by VBIOS at adapter init.

## Recommended fix

After computing t_diff1/t_diff2, check 'if (t_diff1 == 0 || t_diff2 == 0)' and clear PHM_PlatformCaps_MicrocodeFanControl + return 0.

## Kernel references (confirmed during verification)

- sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:2048-2051
- sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:2058-2059

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`