{
  "finding_id": "DF-2496",
  "title": "Kernel divide-by-zero panics from crafted RAID geometry (width/interleave/total_sectors == 0)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "guest /root/dfrig3: ./build.sh (compiles production sys/dev/disk/nata/ata-raid.c into dfrig3_ata.ko via #include + builds atastat)",
    "run": "kldload ./dfrig3_ata.ko; sysctl kern.dfrig3_ata_test=12 (non-fatal setup); then one per boot: =20 (strategy), =21 + /root/dfrig3/atastat 0 (real ioctl), =22 (attach)",
    "expected": "test12: parser installs interleave=0 and total_sectors=0 verbatim (rc=1, READY). test20: Fatal trap 18 integer divide fault, Stopped at ata_raid_strategy+0x2f3: divq. test21: Fatal trap 18, Stopped at ata_raid_ioctl+0x11b: divq 0x48(%r14) (real kernel IP, real userland ioctl). test22: Fatal trap 18 divq (attach inlined)."
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-raid.c:359-361",
    "sys/dev/disk/nata/ata-raid.c:366-373",
    "sys/dev/disk/nata/ata-raid.c:1028",
    "sys/dev/disk/nata/ata-raid.c:157-158",
    "sys/dev/disk/nata/ata-raid.c:181",
    "sys/dev/disk/nata/ata-raid.c:2229",
    "sys/dev/disk/nata/ata-raid.c:2231"
  ],
  "fix": "fix.diff: guard strategy RAID0/01 (!interleave || !width) and RAID5 (!interleave || width<2) with biofinish(EIO); status->progress ternary; attach rounddown + heads&&sectors ternaries",
  "artifacts": [
    "README.md", "VERDICT.md", "dfrig3_ata.c", "Makefile", "atastat.c",
    "build.sh", "run.sh", "run_nonfatal.log", "env.txt",
    "panic_strategy.txt", "panic_status_ioctl.txt", "panic_attach.txt",
    "fix.diff", "fix_build.log", "fix_validation.log", "manifest.json", "verdict.json"
  ]
}