# DF-2479 — PoC verdict

**File:** `sys/dev/disk/mmcsd/mmcsd.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

mmcsd_delete() uses mmc_get_erase_sector(dev) directly as a divisor and modulo operand with no validation. The mmc layer derives erase_sector from raw attacker-controlled CSD fields; a crafted card reporting a small product (<512) yields 0, and BIO_DELETE/TRIM panics with divide-by-zero.

### Cited lines

- `sys/dev/disk/mmcsd/mmcsd.c:407-411`

## Why it does not reproduce on this guest

No mmc/sd controller or card on the QEMU guest (no /dev/mmcsd*; mmcsd module not loaded).

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Guard erase_sector==0 in mmcsd_delete: set b_error=EINVAL, B_ERROR, biodone, and return before the divisions.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)