{
  "finding_id": "DF-3707",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-certain divide-by-zero: vega10_get_sclk_od (:4540) and vega10_get_mclk_od (:4591) divide by golden_dpm_tables top clock value, which is 0 when the crafted VBIOS dep tables first/max entry has ulClk==0 (setup_default_single_dpm_table :1209 appends entry 0 unconditionally); the pp_sclk_od sysfs attr is world-readable (amdgpu_pm.c:1019 S_IRUGO), so once such a VBIOS is present any local user can trigger the kernel #DE panic. Confidence likely only because the full chain (0-clock golden table accepted through earlier stages) is argued from source, not executed. Not reproducible on the virtio-only audit guest (0 AMD PCI devices).",
  "exploit_chain": "crafted VBIOS (single 0MHz GFXCLK/MCLK dep entry) -> unprivileged cat pp_sclk_od -> DIV_ROUND_UP(x,0) #DE -> panic (DoS)",
  "evidence": "VERDICT.md; run.log (guest-src excerpt :4535-4540); trigger_notes.c (arithmetic demo); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4540",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4591",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:1209",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:1019"
  ],
  "poc_changes": "no runnable PoC possible (hardware-gated); documented chain + arithmetic",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "n/a (sysfs read trigger)",
  "run_cmd": "n/a on guest (no AMD hw)",
  "code_hash": "0f299d4423e63e97f19bc72145e5f88e4e9055cc4b50791bd54750165effb7f6",
  "notes": "Checklist (i)-adjacent OD-range defect; kept Low severity due to crafted-VBIOS precondition.",
  "recommended_fix": "Guard golden_value==0 and return 0 in both getters (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; no AMD hw on guest so no patched-kernel validation possible",
  "fix_evidence": "fix.diff; run.log hardware gate"
}