# DF-3621 VERDICT — divide-by-zero on VBIOS spread-spectrum rate == 0

## Bottom line

**Real bug, source-certain; runtime inconclusive (no AMD GPU on guest).**

Two unguarded kernel integer divisions by the VBIOS-controlled spread
spectrum rate:

- `ci_calculate_sclk_params()` — ci_dpm.c:3337
  `clk_s = reference_clock * 5 / (reference_divider * ss.rate);`
- `ci_calculate_mclk_params()` — ci_dpm.c:2981
  `clks = reference_clock * 5 / ss.rate;`

`ss.rate` is filled by `amdgpu_atombios_get_asic_ss_info()`
(amdgpu_atombios.c:896-992) with **no zero validation** in any of the three
table revisions, and the V2/V3 paths additionally do `ss->rate /= 100`
(:959/:984), so even a non-zero VBIOS value below 100 (in 10Hz units)
truncates to exactly 0.

Reachability: `pi->caps_sclk_ss_support` / `caps_mclk_ss_support` are set to
true whenever the `ASIC_InternalSS_Info` header parses (ci_dpm.c:6052-6056);
the divides then execute for every graphics/memory level during
`ci_dpm_enable → ci_init_smc_table → ci_populate_all_graphic_levels /
ci_populate_all_memory_levels` (ci_dpm.c:3432-3444 / 3479-3487) — i.e., at
driver bind with a crafted VBIOS, and again on each resume.

On x86-64 a kernel integer division by zero raises #DE → panic.

## Verification narrative

- Guest has no AMD ASIC (ramfb only) → kernel path unexecutable →
  **inconclusive**; module presence verified.
- Logic PoC `ci_ss_div0.c` executed on the guest reproduces both the
  V2/V3 `/= 100` truncation-to-zero and the actual machine division
  trapping (`run.log`: SIGFPE caught at sink [A], the ci_dpm.c:3337
  expression; sinks [B]/[C] are the same instruction pattern).
- Distinct from known DF-1143 (fan-table t_diff div-by-zero): different
  operands, different functions, different VBIOS fields. Twin: si_dpm
  DF-3612.

## Fix

`fix.diff` wraps each SS-programming block in `if (ss.rate)` — skipping SS
setup for a zero rate is safe (the SSEN enable bit is simply not set).
Not testable on this guest (no AMD hardware).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.