# DF-3612 — Verdict

## Verdict: REPRODUCED (source-level + harness) — integer divide-by-zero (#DE) panic from crafted-VBIOS SS rate

Same malicious-VBIOS DoS family as DF-1137 (fan t_diff) but a **distinct sink
pair** not covered by it.

## Bug confirmation

The SS rate comes straight from the VBIOS with no zero check:

```c
radeon_atombios.c:1543-1548   ss->percentage = le16(usSpreadSpectrumPercentage);
                              ss->type       = ucSpreadSpectrumMode;
                              ss->rate       = le16(usSpreadRateInKhz);   // no check
                              return true;                                // "found"
```

si_dpm.c then divides by it on every matching state:

```c
si_dpm.c:4829-4832  (si_calculate_sclk_params, pi->sclk_ss)
    if (radeon_atombios_get_asic_ss_info(rdev, &ss, ASIC_INTERNAL_ENGINE_SS, vco_freq)) {
        u32 clk_s = reference_clock * 5 / (reference_divider * ss.rate);   // :4831 #DE
        u32 clk_v = 4 * ss.percentage * fbdiv / (clk_s * 10000);          // :4832 #DE when clk_s==0

si_dpm.c:4929-4932  (si_populate_mclk_value, pi->mclk_ss)
    if (radeon_atombios_get_asic_ss_info(rdev, &ss, ASIC_INTERNAL_MEMORY_SS, freq_nom)) {
        u32 clks = reference_clock * 5 / ss.rate;                          // :4931 #DE
```

`pi->sclk_ss` / `pi->mclk_ss` are enabled by `rv770_get_engine_memory_ss`
(si_dpm.c:7029) from the SAME VBIOS SS tables, so a crafted BIOS that sets
the SS-support firmware flag plus a zero-rate entry arms both sinks. The
functions run for every performance level of every power state during
`si_dpm_enable` (si_convert_power_level_to_smc -> si_populate_sclk_value /
si_populate_mclk_value). On x86-64, `div` with divisor 0 raises #DE ->
kernel panic.

## Harness confirmation

`run.log`:

```
[A1] engine SS ... child died from SIGFPE (signal 4): integer divide by zero
[A2] memory SS ... child died from SIGFPE (signal 4): integer divide by zero
[B]  rate=0 -> rc=-1 (SS skipped, no trap) ... rate=30 -> rc=0
```

## Trigger conditions (not met on this guest)

SI GPU + radeon DPM (guest is virtio-only) + crafted VBIOS SS entry.

## Exploit chain

None — #DE is not steerable; boot-time DoS panic.

## Fix

`fix.diff` — `if (ss.rate == 0) return -EINVAL;` in both SS blocks.
Validation: apply-check OK; `make si_dpm.o` -Werror clean (stacked);
harness `[B]` no trap, sane-rate path unchanged (rc=0, clk values computed).

`fix_status: fixed` (compile + harness-level).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.