# DF-2451 - Verification Verdict

**Status:** reproduced
**Impact:** panic
**Confidence:** certain

## Mechanism
dm_pdev_correct_dump_offset divides pdev_pinfo.media_offset / pdev_pinfo.media_blksize; when DIOCGPART failed at dm_pdev_insert time (error path only kprintf-s at dm_pdev.c:174-176 and leaves the zeroed partinfo), media_blksize is 0 and the dump path divides by zero - a panic exactly when the system is trying to write a crash dump.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain (dump-path-only div0; requires dumpdev on a dm pdev whose underlying DIOCGPART failed - not drivable on this guest).

## Threat / reachability
Dump-time divide-by-zero panic (worst possible moment) after a failed DIOCGPART on a dm pdev.

## Privilege escalation assessment
n/a (hardening)

## Fix
Fall back to no geometry adjustment when media_blksize == 0.

## Kernel references
- `sys/dev/disk/dm/dm_pdev.c:107`
- `sys/dev/disk/dm/dm_pdev.c:174`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.