# DF-2415 — adwcam.c divide-by-zero in XPT_CALC_GEOMETRY

## Verdict: NOT REPRODUCED (hardware-gated) — source bug CONFIRMED real (partially mitigated upstream); fix.diff compiles.

**Classification:** `not_reproduced` / HW-gated / impact=none. No AdvanSys (adw) HBA
on this guest. The div-by-zero is **real in source**; the defense-in-depth `fix.diff`
**compiles cleanly** (`nativekernel rc=0`, `-Werror`, `-DINVARIANTS`).

### Why not reproduced (the gate)

The bug is in `adw_action()` `XPT_CALC_GEOMETRY` of the **adw (second-generation
AdvanSys) SCSI HBA driver** (`sys/dev/disk/advansys/adwcam.c`). The guest has **no
AdvanSys PCI HBA** and the module is **not loaded** (`kldstat`: only `kernel`,
`ehci.ko`, `xhci.ko`). The handler is never invoked.

Gate proof (this guest):
```
$ kldstat              ->  kernel, ehci.ko, xhci.ko   (no adw/advansys)
$ pciconf -l           ->  no AdvanSys (0x10cd/*) / no SCSI HBA at all
$ camcontrol devlist   ->  only QEMU DVD-ROM on PIIX3 ata-cam
```

### The source bug (real, cited `path:line`)

`sys/dev/disk/advansys/adwcam.c`, `adw_action()` `XPT_CALC_GEOMETRY` (`:722-756`):
- `size_mb = ccg->volume_size / ((1024L * 1024L) / ccg->block_size);` (`:734-735`) —
  the same inline geometry calc as the advansys driver, **without** the `block_size==0`
  guard that the shared `cam_calc_geometry` helper and the mpt SIM perform.
- **Sink 1** (block_size==0): inner `1048576L / 0` → `#DE`. **Mitigated upstream**
  by the XPT core filter at `sys/bus/cam/cam_xpt.c:3063` (which rejects
  `block_size==0` before dispatch to the SIM), so unreachable via da→`dasetgeom`.
- **Sink 2** (block_size > 1 MiB / non-divisor of 1 MiB → inner quotient 0 → outer
  `volume_size / 0`): **NOT mitigated** by the core filter — real latent bug.
- Data flow identical to DF-2411: READ CAPACITY → `scsi_da.c:1831` → `dasetgeom` →
  `ccg->block_size` → `xpt_action(XPT_CALC_GEOMETRY)` → `adwcam.c:734`.

Attacker model: malicious SCSI device on an adw (AdvanSys) bus during auto-probe.

### Exploit chain

Not developed — no adw HBA, no target. Valid hard blocker: dead driver code path on
this guest.

### Fix (defense-in-depth, validated to compile)

`fix.diff` guards `ccg->block_size` (`== 0`, `> 1 MiB`, non-divisor of 1 MiB) before
the division. Validated in the combined `nativekernel` build (`fix_build.log`).

### Reproduce

No runnable PoC on this guest (no adw HBA). Artifacts: `env.txt`, `fix.diff`,
`fix_build.log`.