# DF-1708 — verification verdict

| Field | Value |
|-------|-------|
| **Verdict**     | SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest) |
| **Impact**      | panic (DoS) |
| **Confidence**  | certain (source-trace) |
| **Guest**       | DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 |
| **Module/kernel** | not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel |
| **Citations**   | sys/dev/drm/radeon/radeon_clocks.c:373, sys/dev/drm/radeon/radeon_clocks.c:379 |

## Mechanism

calc_eng_mem_clock at radeon_clocks.c:373 divides by (2*spll->reference_freq) and at 379 by ref_div without validating either is non-zero. spll->reference_freq/ref_div are read from VBIOS. A zero value causes divide-by-zero panic.

**Root cause:** Missing zero-check on VBIOS-sourced PLL divisor.

## Reproduction note (HW/module-gated)

DF-1708 lives in `sys/dev/drm/radeon/radeon_clocks.c` which is either (a) not compiled into the
default `X86_64_GENERIC` kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt
driver only — loaded via kldload) or (b) gated by absent hardware on this
audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID
controller, no CardBus bridge). The bug is **source-confirmed** by tracing
the cited path line-by-line; a live trigger would require the corresponding
hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build
validated in this run.

## Fix

Add 'if (spll->reference_freq == 0 || ref_div == 0) return 0;' before the divisions. Matches finding proposal intent.


## Phase 8 — combined fix-kernel build validation

`fix.diff` was one of 35 standalone `git apply`-able patches batched into a single
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest.

**Result:** combined kernel build **rc=0** with `-Werror` clean (no warnings).

- Build log: `combined_build.log` (35666 lines, full untrimmed `make` output).
- Single-fix kernel artifact:
  `/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped`
  sha256 `eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7`,
  built `Wed Jul 22 15:42:55 UTC 2026`.
- All 35 patches applied cleanly via `patch -p1 --forward` (no rejects).

Because DF-1708 is HW/module-gated (not compiled into the default GENERIC kernel
or requires hardware absent on the audit guest), the combined kernel was not
booted for a runtime re-test; the source-level correctness of the fix is
validated by the rc=0 -Werror build, which is the appropriate validation for
HW-gated findings.