# DF-2946 — `kern.stathz` boot tunable fetched with no validation → boot-time integer divide fault

`sys/kern/subr_param.c:202` (`init_param1`) overwrites the computed `stathz`
(default `hz + 1`) with the raw loader tunable `kern.stathz` and never
validates it. The value flows into `initclocks_other()`
(sys/kern/kern_clock.c:438-441), which registers the per-CPU statclock
systimer with `SYSTF_MSSYNC`. `_systimer_init_periodic()`
(sys/kern/kern_systimer.c:270-273) then computes the timer period with an
unguarded division:

```c
if ((flags & SYSTF_MSSYNC) && freq <= 1000)
        info->periodic = sys_cputimer->fromhz(1000) * (1000 / freq);  /* 1000/0 */
else
        info->periodic = sys_cputimer->fromhz(freq);                  /* freq/freq */
```

and `cputimer_default_fromhz()` (sys/kern/kern_cputimer.c:197-200) divides
`sys_cputimer->freq / freq` on the other branch.

* `kern.stathz="0"`  → **integer divide fault panic during boot** (demonstrated).
* `kern.stathz="-N"` → signed period, garbage modulo/expiry math, broken statclock.
* `kern.stathz` huge → multi-GHz statclock (interrupt storm / unusable system).

Sibling of DF-0173 (kern.hz=0 divides at subr_param.c:204-207 *inside*
init_param1); this member survives init_param1 and detonates later, at
SI_BOOT2_POST_SMP. The `clkinfo` sysctl handler even guards for this
(`stathz ? stathz : hz`, kern_clock.c:1337) — the systimer path does not.

## Reproduce (host side, guest up & clean)

```sh
dfbsd-qemu/vm.sh run_root 'cp /boot/loader.conf /boot/loader.conf.df2946bak && printf "kern.stathz=\"0\"\n" >> /boot/loader.conf && sync'
dfbsd-qemu/vm.sh run_root 'shutdown -r now'
sleep 75; dfbsd-qemu/vm.sh status     # -> down
grep -n "Fatal trap" dfbsd-qemu/boot.log
dfbsd-qemu/vm.sh reset with-src
```

## Expected output

Guest never reaches ssh (`vm.sh status` → down ~75 s after reboot command);
serial console (dfbsd-qemu/boot.log, see panic.txt) shows, immediately after
"Initialize MI interrupts for 6 cpus":

```
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 0; lapic id = 0
...
kernel: type 18 trap, code=0
CPU0 stopping CPUs: 0x0000003e
Stopped at      -0x7f9a53d9:    idivq   %r12,%eax
db>
```

Impact: unbootable system (boot-time kernel panic). Trust boundary:
/boot/loader.conf (root / loader prompt / console), same as DF-0173.