# PoC DF-1463: dpt_action XPT_CALC_GEOMETRY divide-by-zero when block_size==0

**Class:** divide-by-zero (DoS panic)
**Cited site:** `sys/dev/raid/dpt/dpt_scsi.c:1025-1026`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — dpt(4) is in GENERIC but only attaches to DPT Smartcache RAID HBAs (ISA/EISA/PCI). Not present in the audit guest; trigger is a malicious SCSI target reporting block_size=0 in READ CAPACITY.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/raid/dpt/dpt_scsi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 1025-1026 `size_mb = ccg->volume_size / ((1024L * 1024L) / ccg->block_size);` — ccg->block_size (u32) is supplied by da(4) periph from READ CAPACITY with no validation. block_size==0 → inner integer divide by zero → #DE → kernel panic.

## Realistic impact ceiling

panic (DoS)

## Fix

Add `if (ccg->block_size == 0)` guard at the top of XPT_CALC_GEOMETRY that fails the CCB with CAM_REQ_CMP_ERR.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1463.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1463.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/raid/dpt && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```