# DF-1392 — Verification Verdict

## Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)

**Status:** inconclusive (HW-gated / not reachable as unprivileged maxx)
**Impact:** none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only)
**Confidence:** certain (source-trace confirmed bug is real)

## Mechanism

rv6xx_program_memory_timing_parameters at :811-814 computes sqm_ratio = 64*high_clock/sclks[LOW|MEDIUM|HIGH]. sclks[] are populated from VBIOS usEngineClock (no zero check). If any sclk==0, #DE div-by-zero panic. Also rv6xx_calculate_spread_spectrum_clk_s at :546 computes (ref_freq*10)/(ss_rate*2) where ss_rate from VBIOS — ss_rate==0 causes #DE. The mclk_ss path is live when ASIC_INTERNAL_MEMORY_SS is advertised.

**Source:** `sys/dev/drm/radeon/rv6xx_dpm.c:811-814, 546`

## Why it cannot be reproduced on this guest

HW-gated. radeon.ko is a loadable module (not in GENERIC); requires ATI/AMD radeon GPU hardware (RV6xx/RV7xx ASIC). No GPU in QEMU guest. Module is not loaded and no device node exists.

## Phase 6: Escalation Assessment

This is a **HW-gated GPU module (radeon DPM)** finding. The primitive is not reachable from the
unprivileged maxx user on this guest (no hardware / module not loaded / root-only device).
No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not
present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest.
For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx
(uid 1001) has no operator group membership.

## Fix

Guard all divisors: return early if any sclk==0 before sqm_ratio; return 0 if ss_rate==0 in calculate_spread_spectrum_clk_s.

**Fix description:** Add zero-check guards before all divisions by VBIOS-derived clock values.

The full git-apply-able diff is in `fix.diff`. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via `make nativekernel` rc=0).

## Classification

- **status:** inconclusive
- **reproduced:** 0
- **impact:** none
- **fix_status:** not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)