# DF-3707 — vega10_get_sclk_od / vega10_get_mclk_od divide by zero when the top golden clock is 0 (crafted VBIOS)

File: sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c (pass 2).

## Bug (:4529-4543, :4580-4594)
	int value = sclk_table->dpm_levels[sclk_table->count - 1].value;         // :4535
	int golden_value = golden_sclk_table->dpm_levels
			[golden_sclk_table->count - 1].value;                            // :4536-4537

	value -= golden_value;
	value = DIV_ROUND_UP(value * 100, golden_value);                          // :4540  <- /0

`golden_sclk_table` is the saved default dpm table; `vega10_setup_default_single_dpm_table`
(:1200-1217) appends entry 0 unconditionally (`i == 0 ||`), so a GFXCLK dependency table whose
entries are all ulClk == 0 (e.g. ucNumEntries == 1 with ulClk == 0) produces
dpm_levels[0].value == 0, count == 1 → `golden_value == 0` → integer division by zero →
kernel trap (#DE) → panic. Identical shape for MCLK at :4586-4591.

## Reachability (wider than the other vega10 findings)
The sysfs node is WORLD-READABLE: amdgpu_pm.c:1019-1020
`static DEVICE_ATTR(pp_sclk_od, S_IRUGO | S_IWUSR, amdgpu_get_pp_sclk_od, ...)` —
`cat /sys/class/drm/card0/device/pp_sclk_od` by ANY local user calls get_sclk_od →
DIV_ROUND_UP → #DE. Precondition is still the crafted-VBIOS (golden 0 clock), so overall
severity Low.

## Trigger (requires AMD Vega10 hardware)
VBIOS with a single GFXCLK dependency entry ulClk=0 (and matching MCLK for the mclk twin),
then any local unprivileged `cat .../pp_sclk_od`.

## PoC status
Guest virtio-only → inconclusive, source-certain.