# DF-3355 VERDICT — reproduced

## Root cause
config_red() copies ioc_fs->lookup_step into the flowset without any validation (ip_dummynet3.c:1374). When a RED flowset with lookup_step==0 has a flow queue that goes idle with a non-zero average and then receives one more packet, red_drops() executes u_int t = (curr_time - q->q_time) / fs->lookup_step (:904) -> integer divide fault. Reproduced 1/1 on the stock guest: 'Fatal trap 18: integer divide fault', Stopped at dummynet_io+0x8c2: divq %rsi,%eax (red_drops is inlined into dummynet_io); the only #DE-capable division reachable in that function under this config is the lookup_step one (fs weight is 1). Trigger: RED fs (w_q=65536 so avg jumps to SCALE(1) on the 2nd packet), 3 packets to build avg>0, wait for the queue to empty, one more packet. Identical code to v1 DF-0375 (sys/net/dummynet/ip_dummynet.c); missed by pass-1 of this file (DF-0382 only covers config_red's own max_th/(max_th-min_th) divisions).

## Exploit chain
root: setsockopt pipe{slow} + fs{DN_IS_RED, w_q=65536, lookup_step=0, mask dst-port}; 3 quick UDP pkts to one flow (3rd sees q_size!=0 -> avg>0), 1 pkt to a second flow (keeps scheduler busy so the idle-flush at :614 cannot mark/expire the victim queue), wait 200ms, 1 more pkt to the first flow -> red_drops q_size==0 && avg!=0 branch -> divq by zero -> panic. No uid=0.

## Evidence
- panic.txt: Fatal trap 18 integer divide fault, dummynet_io+0x8c2 divq %rsi,%eax
- run.log: RED config + 5-packet choreography transcript
- dfv3.c: redzero subcommand

## Kernel refs
- sys/net/dummynet3/ip_dummynet3.c:1374
- sys/net/dummynet3/ip_dummynet3.c:904
- sys/net/dummynet3/ip_dummynet3.c:1108

## Fix validation
fix.diff hunk: sanitize lookup_step<1 to 1 in config_red (fix.diff hunk 5). See verdict.json fix_* fields — a single guest
kernel rebuilt with the union fix.diff (all five findings) was re-tested with
the exact same PoCs: baseline panic/growth reproduced on the stock kernel,
patched kernel rejects or sanitizes the bad configs and shows none of the
five defects (details in fix section of verdict.json).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.