{
  "finding_id": "DF-3682",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Divide-by-zero in drm_gtf_mode_complex (sys/dev/drm/drm_modes.c:484-485): GTF_M/GTF_2C/GTF_K/GTF_2J are taken unvalidated from a sink-supplied EDID range-limit descriptor (drm_edid.c:2188 via drm_gtf2_*, drm_edid.c:2026-2055). With M=0 (r[15]=r[14]=0) and 2C=2J=200 (r[13]=r[17]=200), C=100 and M=0 make ideal_duty_cycle exactly 100000, so the divisor (100000 - ideal_duty_cycle) is zero -> kernel #DE -> panic. The in-kernel trigger could not be executed on this guest (virtio-only: no /dev/dri, no drm kld, no GPU, no virtio-gpu driver in the tree), so the run is classified not_reproduced; however the fault itself is proven deterministically by compiling a MECHANICAL byte-for-byte extraction of the kernel function from the audit tree (guest /usr/src copy md5-identical) and feeding it only values decoded from the crafted 128-byte checksum-valid EDID (evil_edid.bin): SIGFPE exit 136, 3/3 runs. Reachability of the call in-kernel is proven by line-level trace (README.md/VERDICT.md steps 1-6): base-block-only EDID, no extensions needed, sink-driven physical vector identical to DF-1165s threat model. The identical formula is still present in upstream Linux v6.6 (no known CVE).",
  "exploit_chain": "crafted EDID base block (range descriptor flags=0x02 with degenerate GTF2 params + ordinary standard timing) -> DDC/AUX read -> drm_do_get_edid -> drm_add_edid_modes -> add_standard_modes -> drm_mode_std LEVEL_GTF2 -> drm_gtf_mode_complex -> hblank division by zero -> kernel panic. No escalation route (pure DoS).",
  "evidence": "run.log: baseline exit=136 3/3 (SIGFPE) + fix test exit=0; gtf_body.inc = verbatim extraction (md5-proven identical source on guest); evil_edid.bin/gen_edid.py = malicious sink payload with valid checksum; env.txt = guest has no /dev/dri, no drm kld; fix.diff = divisor guard validated at extracted-function level (gtf_fix_test.c)",
  "kernel_refs": [
    "sys/dev/drm/drm_modes.c:484",
    "sys/dev/drm/drm_modes.c:480",
    "sys/dev/drm/drm_edid.c:2188",
    "sys/dev/drm/drm_edid.c:2066",
    "sys/dev/drm/drm_edid.c:2026",
    "sys/dev/drm/drm_edid.c:2095",
    "sys/dev/drm/drm_edid.c:4770"
  ],
  "poc_changes": "No runnable kernel path exists on the guest (no DRM device); PoC pivoted to a mechanical verbatim-extraction harness compiled from the trees own drm_gtf_mode_complex body, driven purely by EDID-decoded values; fix validated on the same extracted body.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root sh /tmp/build.sh  (cc -O2 -w -o gtf_extract gtf_kernel_extract.c && cc -O2 -w -o gtf_fix_test gtf_fix_test.c)",
  "run_cmd": "vm.sh run_root sh /tmp/run.sh",
  "code_hash": "893c6eb46bfee3fef2fdd8ba16258efbd2b5798e2c2bd04d694965d05995f1ab",
  "notes": "Upstream-shared: identical unguarded formula present in Linux v5.2 and v6.6 (verified via raw.githubusercontent.com); no CVE assigned to date. Guest stayed clean (no kernel build, no panic, files only in /tmp). Guest /tmp artifacts left in place; no reset needed (nothing dirtied).",
  "recommended_fix": "Guard the blanking computation: reject ideal_duty_cycle <= 0 || >= 100000 in drm_gtf_mode_complex (destroy mode, return NULL); both call sites already handle NULL.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Kernel-level fix validation impossible on this guest (baseline in-kernel trigger itself untestable: no DRM device). Guard logic validated at the extracted-function level: gtf_fix_test.c (same verbatim body + fix.diff guard) returns NULL with no trap, exit 0, while the unguarded baseline traps 3/3.",
  "fix_evidence": "findings/poc/DF-3682/run.log (fix test section), findings/poc/DF-3682/gtf_body_fixed.inc, findings/poc/DF-3682/fix.diff"
}