# DF-3743 — Spread-spectrum rate parsed to zero (raw 0, /=100 truncation, or never assigned) reaches DPM SS divisions (#DE panic)

**Severity**: Medium · **CWE**: CWE-369 Divide By Zero · **File**: sys/dev/drm/radeon/radeon_atombios.c:1546, 1564-1569, 1586-1594, 1390-1413

## What this is
Parse-side root of the SS-rate divide-by-zero family (sink side already filed as DF-3621 [si] / DF-3647 [ci]). radeon_atombios_get_asic_ss_info() returns success with ss->rate==0 via three distinct paths: v1 stores usSpreadRateInKhz verbatim (:1546); v2/v3 store usSpreadRateIn10Hz then integer-divide by 100 for ENGINE/MEMORY SS (:1569, :1594) so any value <100 truncates to 0. radeon_atombios_get_ppll_ss_info() never assigns rate at all (memset at :1390 remains) yet returns true (:1400-1413). Sinks divide by ss.rate: si_dpm.c:4833 and ci_dpm.c:3229 (clk_s = reference_clock * 5 / (reference_divider * ss.rate)). Harness on guest: v3 parse of usSpreadRateIn10Hz=50 -> rate=0 -> verbatim sink expression -> SIGFPE (exit 42). Kernel path unreachable on this guest.

## Reproduce
```
./build.sh    # cc -O1 -g -Wall -o <bin> harness_ssrate.c   (DragonFly guest, cc 8.3)
./run.sh      # expected: ss.rate=0 after parse; sink division SIGFPE at stage 1, exit_code=42
```
The harness replicates the kernel parse arithmetic VERBATIM (cited path:line) against a
synthetic crafted-VBIOS buffer with canary-guarded destinations.

## Guest / environment
Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log).
See env.txt (uname, cc, kldstat, /boot/kernel/radeon.ko presence).

## Fix
treat rate==0 entries as invalid (return false / skip) — see fix.diff (authored after verification; never applied to sys/).