# DF-3352 — negative flowset weight reaches p->sum==0 -> integer divide-by-zero panic in ready_event_wfq

**File:** sys/net/dummynet3/ip_dummynet3.c (pass 2)
**Severity:** Medium (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) — CWE-369 Divide By Zero
**Verdict:** reproduced (panic) on stock INVARIANTS guest, see verdict.json.

## Build
copy `dfv3.c` + `setup.sh` to the guest, then (root):
    cc -O -o /tmp/dfv3 /tmp/dfv3.c

## Run
    sh /tmp/setup.sh      # kldloads ipfw3 (default-accept) + dummynet3, adds queue rules
    /tmp/dfv3 negweight

## Expected
kernel panic signature in serial console (see panic.txt)

`setup.sh` sets `net.filters_default_to_accept=1` BEFORE `kldload ipfw3` —
ipfw3 otherwise boots default-deny and locks out ssh.

## Fix
`fix.diff` (union patch for DF-3352..DF-3356; the hunk for THIS finding is:
clamp weight <=0 to 1 at flowset creation (fix.diff hunk 3)).