# DF-2481 — Divide-by-zero via unchecked IOCFacts reply

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No LSI Logic MPT (Fusion-MPT) HBA in guest: `kldstat` shows only kernel/ehci/xhci;
`pciconf -l` shows no LSI device. The mpt driver does not attach.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/mpt/mpt.c:2683` (via macros at `mpt.h:876-882`)

`mpt_configure_ioc` reads IOCFACTS into `mpt->ioc_facts` and uses
`ioc_facts.RequestFrameSize` as a divisor through the macros:
```c
MPT_RQSL(mpt) = mpt->ioc_facts.RequestFrameSize << 2     // mpt.h:876
MPT_NRFM(mpt) = MPT_REQUEST_AREA / MPT_RQSL(mpt)          // mpt.h:882
```
At line 2683: `mpt->max_seg_cnt *= MPT_NRFM(mpt);` — if `RequestFrameSize == 0`,
then `MPT_RQSL == 0`, and `MPT_NRFM` divides by zero, triggering `#DE` and
panicking the kernel at adapter attach. `RequestFrameSize` is a U16 from the
IOCFACTS reply, DMAed by the IOC — fully controlled by a malicious/faulty HBA.

## Fix

Added `RequestFrameSize == 0` validation before any use of `MPT_RQSL`. See `fix.diff`.

## Impact (on HW that has the HBA)

Medium — kernel panic at device attach via malicious PCIe/Thunderbolt device.