# DF-3612 — Integer divide-by-zero in spread-spectrum programming when VBIOS usSpreadRateInKhz == 0 (si_dpm.c:4831 and :4931)

**Severity:** Medium  **Confidence:** certain  **Status:** reproduced (harness)
**Impact:** panic

## What

radeon_atombios_get_asic_ss_info() copies ss->rate from the VBIOS ASIC_InternalSS_Info entry verbatim and returns true; si_calculate_sclk_params:4831 divides by (reference_divider * ss.rate) and si_populate_mclk_value:4931 divides by ss.rate whenever the SS entry matches the target clock (pi->sclk_ss/pi->mclk_ss set from the same VBIOS table). rate==0 -> div -> #DE -> kernel panic during si_dpm_enable power-state upload. Harness executes the exact expressions in forked children: SIGFPE (signal 4) on both sinks == kernel #DE panic. No AMD GPU on the audit guest for a live trigger.

## Reproduce

```
sh build.sh   # cc -O2 -Wall -o harness harness.c
sh run.sh     # prints [A] buggy-path behaviour, [B] fixed-path behaviour
```

Expected decisive output (see run.log): the `[A]` section shows the fault or
corruption the kernel would take; the `[B]` section shows the behaviour with
fix.diff applied.

No AMD GPU is attached to the audit QEMU guest (virtio-only), so the radeon
DPM path cannot be exercised live; the harness replicates the exact kernel
expressions with crafted-VBIOS inputs (house methodology, cf. DF-1137..1140).

## Fix

`fix.diff` — validated: `git apply --check` clean; `make si_dpm.o` in
sys/dev/drm/radeon with KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
compiles -Werror clean with all five pass-2 fixes stacked; harness `[B]`
shows the primitive gone.