# DF-2069 PoC — ata_serverworks_tf_write CHS divide-by-zero

## Status: VERIFIED (source-only) + FIX VALIDATED

`ata-serverworks.c:228/230/232/234` divides by `sectors` and
`sectors*heads` loaded from IDENTIFY without the
`current_heads && current_sectors` guard that the sibling
`ata-disk.c:469-470` applies. A device that sets `ATA_FLAG_54_58` but
reports `current_sectors == 0` makes the next I/O request divide by
zero → kernel panic.

HW-gated on the audit guest (virtio-only, no ServerWorks ATA
controller). See `VERDICT.md` for the source trace and fix validation.

## Reproduce

```
./build.sh   # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh     # source-only confirmation; no runtime PoC (HW-gated)
```

## Fix

`fix.diff` adds the missing `current_heads && current_sectors` clause
to the `atavalid` check (matching `ata-disk.c:469`) plus a final
`if (heads == 0 || sectors == 0) { request->result = EIO; return; }`
defense before the divisions.