# DF-1376 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unguarded divide-by-zero in spread-spectrum step_size when pll reference clock is zero

## Source Location
sys/dev/drm/radeon/atombios_crtc.c:1129-1132

## Verdict
Source-confirmed: Unguarded divide-by-zero in spread-spectrum step_size when pll referen. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
atombios_crtc_set_pll at atombios_crtc.c:1129: step_size=.../(125*25*pll->reference_freq/100). reference_freq from VBIOS usReferenceClock (radeon_atombios.c:1146) with no zero-guard (unlike pll_out_min/default_dispclk which have fallbacks). dcpll set via *dcpll=*p1pll. reference_freq==0 -> div-by-zero panic on SS-enabled modeset on DCE4+. Crafted/corrupt VBIOS. Local user with DRI access triggers modeset. Fix: guard reference_freq!=0 and ss_div!=0.