DF-2343 panic signatures -- DragonFly 6.5-DEVELOPMENT, UMCSH harness kernel
(verbatim umcs.c TU-compiled with -O0 semantics for the verbatim unit;
ucom/usb framework + tty layer 100% stock, compiled in).

All three trigger routes reach the SAME faulting instruction:
  umcs7840_calc_baudrate+0x90 = 0xffffffff80a856c6 = `divl -0x14(%rbp)`
  (the division by rate at umcs.c:1066; the 1-element OOB load of
  umcs7840_baudrate_divisors[9] is the instruction right before it at
  +0x84 -- see VERDICT.md / adjacency evidence)

IMPORTANT: with the STOCK shipping codegen (CCVER=gcc80 -O2, which
built the guest's X86_64_GENERIC and the harness kernel by default)
gcc folds the division-by-zero UB: rate==0 returns via
"*divisor=0, *clk=0x80, ret 0" and pre_param then rejects with EINVAL
-- NO panic on the stock binary (verified live, run1.log, and in the
disassembly in adjacency.txt).  The panics below are the literal
C-source semantics under -O0 codegen of the identical source bytes.

=====================================================================
PANIC 1 -- direct dispatch through the real umcs7840_pre_param
           (the exact call usb_serial.c:1680 makes), rate=0
=====================================================================
UMCSH preparam: dispatching real umcs7840_pre_param(ucom, t.c_ospeed=0) -- the exact call usb_serial.c:1680 makes
UMCSH preparam: ABOUT TO ENTER (stock kernel: expect Fatal trap 0 divide error)

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer	= 0x8:0xffffffff80a856c6
stack pointer	        = 0x10:0xfffff80117d175b0
frame pointer	        = 0x10:0xfffff80117d175d8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 807
current thread          = pri 6
trap number		= 18
panic: integer divide fault
cpuid = 1
Trace beginning at frame 0xfffff80117d17418
trap_fatal() at trap_fatal+0x301
trap() at trap+0x457
calltrap() at calltrap+0x9
--- trap 0000000000000012, rip = ffffffff80a856c6, rsp = fffff80117d175a0, rbp = fffff80117d175d8 ---
umcs7840_calc_baudrate() at umcs7840_calc_baudrate+0x90 0xffffffff80a856c6
umcs7840_pre_param() at umcs7840_pre_param+0x29 0xffffffff80a8488d
umcsh_scenario() at umcsh_scenario+0x48a
boot() called on cpu#1
Dumping 550 MB ... Dump complete

=====================================================================
PANIC 2 -- UNPRIVILEGED first open of /dev/cuaU0.0 (user maxx,
           dialer group) through the STOCK tty->ucom open path:
           ucom_dev_open -> ucom_open -> usb_serial.c:839-842
           (t = sc_it_in, never initialized, c_ospeed==0)
           -> ucom_param -> pre_param -> calc_baudrate
=====================================================================
tioc0: opening /dev/cuaU0.0 (uid=1001) -- sc_it_* untouched, c_ospeed==0 flows to ucom_pre_param on first open

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 2; lapic id = 2
instruction pointer	= 0x8:0xffffffff80a856c6
current process		= 867          <- maxx's tioc0
panic: integer divide fault
Trace beginning at frame 0xfffff801186d92b8
trap_fatal() at trap_fatal+0x301
trap() at trap+0x457
calltrap() at calltrap+0x9
--- trap 0000000000000012, rip = ffffffff80a856c6, rsp = fffff801186d9440, rbp = fffff801186d9478 ---
umcs7840_calc_baudrate() at umcs7840_calc_baudrate+0x90 0xffffffff80a856c6
umcs7840_pre_param() at umcs7840_pre_param+0x29 0xffffffff80a8488d
ucom_param() at ucom_param+0xa8 0xffffffff80a66178     <- usb_serial.c:1680 dispatch
boot() called on cpu#2
Dumping 680 MB ... Dump complete

=====================================================================
PANIC 3 -- USB serial console route (the finding's primary claimed
           trigger): loader tunables hw.usb.ucom.cons_unit=0 and
           hw.usb.ucom.cons_baud=0; panic DURING ucom_attach ->
           ucom_attach_tty console block (usb_serial.c:511-533),
           after the GPIO/MODE reads and transfer setup succeeded
=====================================================================
UMCSH attach: ABOUT TO enter real umcs7840_attach()
UMCSH SIM: RD  reg 0x07 port 0 -> 0x01
umcs7840: Chip mcs7840, found 4 active ports
UMCSH SIM: RD  reg 0x2b port 0 -> 0x40
umcs7840: On-die confguration: RST: active high, HRD: no, PLL: avail, POR: avail, Ports: 4, EEPROM write enabled, IrDA is not available
UMCSH SIM: transfer_setup ep 0x01 n=2 -> OK (NULL)
[...]
UMCSH SIM: transfer_setup ep 0x09 n=1 -> OK (NULL)

Fatal trap 18: integer divide fault while in kernel mode
cpuid = 1; lapic id = 1
instruction pointer	= 0x8:0xffffffff80a856c6
current process		= 792
panic: integer divide fault
Trace beginning at frame 0xfffff8011780b238
trap_fatal() at trap_fatal+0x301
trap() at trap+0x457
calltrap() at calltrap+0x9
--- trap 0000000000000012, rip = ffffffff80a856c6, rsp = fffff8011780b3c0, rbp = fffff8011780b3f8 ---
umcs7840_calc_baudrate() at umcs7840_calc_baudrate+0x90 0xffffffff80a856c6
umcs7840_pre_param() at umcs7840_pre_param+0x29 0xffffffff80a8488d
ucom_param() at ucom_param+0xa8 0xffffffff80a66178     <- usb_serial.c:523-533 console block
boot() called on cpu#1
Dumping 546 MB ... Dump complete

(Serial-console captures: panic_*_o0_serial.log; note the guest's
 post-dump reboot path livelocked in send_ipiq drain after panics 2/3 --
 a DragonFly shutdown-time issue with a panicked CPU, unrelated to the
 finding; the dump itself completed.)