{
 "finding_id": "DF-2392",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "STOCK kernel (X86_64_GENERIC #0): sysctl -w machdep.acpi_timer_freq=0 is accepted by acpi_timer_sysctl_freq (only the CURRENT frequency is validated at acpi_timer.c:310-311) and forwarded unchanged to cputimer_set_frequency, which divides by it - Fatal trap 18 integer divide fault, Stopped at cputimer_set_frequency+0x10 (divq %rsi,%eax), guest dies. Single privileged sysctl write, deterministic, no special hardware state. Fixed kernel rejects the write with EINVAL (Invalid argument).",
 "exploit_chain": "root-only deterministic kernel panic (local DoS); SYSCAP_NOSYSCTL_WR gate quantified - write requires root, read is world-readable",
 "evidence": "panic.txt (Fatal trap 18 ... Stopped at cputimer_set_frequency+0x10: divq %rsi,%eax); fixed.log (sysctl machdep.acpi_timer_freq=0 -> Invalid argument, RC=1)",
 "kernel_refs": [
  "sys/dev/acpica/acpi_timer.c:307",
  "sys/dev/acpica/acpi_timer.c:316",
  "sys/kern/kern_cputimer.c:190"
 ],
 "poc_changes": "run.sh from the seed pack ran as-is on a fresh stock boot",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 120,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}