# DF-3647 — verdict narrative

## Finding
Integer divide-by-zero in spread-spectrum programming when the VBIOS SS rate is 0 (ci_calculate_mclk_params / ci_calculate_sclk_params)

## Kernel references
- `sys/dev/drm/radeon/ci_dpm.c:2876`
- `sys/dev/drm/radeon/ci_dpm.c:3221`
- `sys/dev/drm/radeon/ci_dpm.c:3227`
- `sys/dev/drm/radeon/radeon_atombios.c:1546`
- `sys/dev/drm/radeon/ci_dpm.c:5953`

## Was it reproduced?
No — not on the kernel path. The audit guest is virtio-only (0 AMD PCI devices, /dev/dri absent, no radeon/drm kld; env.txt), so `sys/dev/drm/radeon/ci_dpm.c` can never execute there. Per the pass-2 instruction for this hardware-gated file, the verdict is **inconclusive** (source-level certainty certain) rather than reproduced.

## Logic-level proof (guest harness)
harness.c models the exact loop/index/division with the exact kernel types and was compiled and executed on the audit guest (`cc -O2 -Wall`, DragonFly 6.5-DEVELOPMENT). Decisive output, stable across 2 runs (run.log, run.2.log):

    SIGFPE (kernel: #DE panic)


## Root cause and reasoning

Source-certain div-by-zero, radeon/ci twin of DF-3612 (si) / DF-3621 (amdgpu ci). radeon_atombios_get_asic_ss_info() copies ss->rate straight from the VBIOS (radeon_atombios.c:1546, usSpreadRateInKhz) with no zero check and returns true on a matching entry. ci_calculate_mclk_params() then computes clks = reference_clock * 5 / ss.rate (ci_dpm.c:2876) and ci_calculate_sclk_params() computes clk_s = reference_clock * 5 / (reference_divider * ss.rate) (ci_dpm.c:3227). Both are u32 divisions; a zero rate raises #DE in kernel context -> panic. Reachable whenever caps_mclk_ss_support/caps_sclk_ss_support are set (they are set unconditionally when the ASIC_InternalSS_Info header parses, ci_dpm.c:5953-5957) and the SS assignment table contains a matching entry with rate==0 - trivially crafted. On-guest harness section [B] proved 100*5/0 faults with SIGFPE (userland analogue of #DE). Kernel path unreachable on this GPU-less guest, so overall inconclusive.

## Exploitability

Crafted VBIOS with an ASIC_InternalSS_Info assignment whose usSpreadRateInKhz is 0 and whose target-clock range covers the boot mclk/sclk -> u32 divide by zero -> kernel panic at DPM enable. DoS only. (Hardware-gated; harness proved the arithmetic fault.)

## Recommended fix
Reject SS entries with rate == 0 (skip SS programming / return -EINVAL) in ci_calculate_mclk_params and ci_calculate_sclk_params.
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.