{
  "finding_id": "DF-2297",
  "title": "Divide-by-zero in fwdma_malloc_multiseg when esize is zero (or negative)",
  "file": "sys/bus/firewire/fwdma.c",
  "lines": [145, 153, 159, 160],
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "guest, root, fresh `vm.sh reset with-src`: cd /root/df229x && sh build.sh  (compiles the unmodified production firewire.c+fwdma.c+fwdev.c into df229x.ko)",
    "run": "kldload ./df229x.ko; sysctl kern.df229x_test=3   # psize=0 -> Fatal trap 18; then reset+redeploy+rebuild and sysctl kern.df229x_test=1  # psize=0x80000000 -> Fatal trap 18",
    "expected": "Fatal trap 18: integer divide fault while in kernel mode; Stopped at dfw_dma_malloc_multiseg+0x139: idivl %esi,%eax (psize=0) / +0x153: divq %rsi,%eax (psize=0x80000000); guest dead in DDB. With fix.diff applied: kern.df229x_status 'STSTREAM err=22, no trap' for both variants + guard probe returns NULL; guest alive."
  },
  "kernel_refs": [
    "sys/bus/firewire/fwdma.c:145",
    "sys/bus/firewire/fwdma.c:153",
    "sys/bus/firewire/fwdma.c:159",
    "sys/bus/firewire/fwdma.c:160",
    "sys/bus/firewire/fwdev.c:107",
    "sys/bus/firewire/fwdev.c:108",
    "sys/bus/firewire/fwdev.c:458",
    "sys/bus/firewire/fwdev.c:486",
    "sys/bus/firewire/fwdev.c:504",
    "sys/bus/firewire/firewire.h:50",
    "sys/sys/param.h:396",
    "sys/sys/param.h:400"
  ],
  "artifacts": [
    "df229x.c", "Makefile", "shim/", "build.sh", "run_bootA.sh", "run_bootB.sh", "run_fix.sh",
    "run.log", "panic.txt", "run_variantB.log", "panic_psize80000000.txt",
    "fix_run.log", "baseline_build.log", "fix_build.log", "env.txt", "fix.diff",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}