# DF-2514 — Divide-by-zero in XPT_CALC_GEOMETRY

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No FireWire (SBP-2) controller in guest: `kldstat` shows only kernel/ehci/xhci;
`pciconf -l` shows no FireWire controller. The sbp driver does not attach.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/sbp/sbp.c:2385-2386`

```c
if (ccg->block_size == 0) {              // line 2370: only checks ==0
    ...
}
size_mb = ccg->volume_size
    / ((1024L * 1024L) / ccg->block_size);  // line 2385-2386: inner div → 0 if block_size > 1MB
```

The guard checks `block_size == 0` but not `block_size > (1024*1024)`. When
`block_size > 1048576`, the inner division `(1024*1024)/block_size` evaluates to 0
(integer truncation), and the outer division `volume_size / 0` triggers `#DE` and
panics. The canonical `cam_calc_geometry` was already fixed; this driver's stale
inline copy predates that fix. `block_size` comes from device READ CAPACITY response,
fully controlled by an attached FireWire SBP-2 device.

## Fix

Changed `if (ccg->block_size == 0)` to
`if (ccg->block_size == 0 || ccg->block_size > (1024L * 1024L))`. See `fix.diff`.

## Impact (on HW that has the controller)

Medium — kernel panic from malicious FireWire SBP-2 device or local user via
`/dev/pass` XPT_CALC_GEOMETRY CCB with `block_size > 1MB`.