{
  "finding_id": "DF-3743",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Parse-side root of the SS-rate divide-by-zero family (sink side already filed as DF-3621 [si] / DF-3647 [ci]). radeon_atombios_get_asic_ss_info() returns success with ss->rate==0 via three distinct paths: v1 stores usSpreadRateInKhz verbatim (:1546); v2/v3 store usSpreadRateIn10Hz then integer-divide by 100 for ENGINE/MEMORY SS (:1569, :1594) so any value <100 truncates to 0. radeon_atombios_get_ppll_ss_info() never assigns rate at all (memset at :1390 remains) yet returns true (:1400-1413). Sinks divide by ss.rate: si_dpm.c:4833 and ci_dpm.c:3229 (clk_s = reference_clock * 5 / (reference_divider * ss.rate)). Harness on guest: v3 parse of usSpreadRateIn10Hz=50 -> rate=0 -> verbatim sink expression -> SIGFPE (exit 42). Kernel path unreachable on this guest.",
  "exploit_chain": "crafted ASIC_InternalSS_Info (v2/v3 rate<100, or v1 rate=0) or PPLL_SS_Info table -> parse returns true with rate=0 -> DPM enable programs SS -> divide-by-zero -> #DE kernel panic",
  "evidence": "harness_ssrate.c + build.log + run.log; VERDICT.md; kernel refs sys/dev/drm/radeon/radeon_atombios.c:1540-1552",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_atombios.c:1540-1552",
    "sys/dev/drm/radeon/radeon_atombios.c:1558-1574",
    "sys/dev/drm/radeon/radeon_atombios.c:1580-1601",
    "sys/dev/drm/radeon/radeon_atombios.c:1390-1416",
    "sys/dev/drm/radeon/si_dpm.c:4833",
    "sys/dev/drm/radeon/ci_dpm.c:3229"
  ],
  "poc_changes": "harness written from scratch (no seed PoC): verbatim kernel arithmetic replica with canary-guarded destination model, built and executed on the DragonFly guest (cc 8.3); fixed nested-comment, stddef/stdint includes and volatile divisors during bring-up",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh (after ./build.sh)",
  "code_hash": "d7475a046f64216c2586adc5c11edef3a10aa58d955887d484da54ca31b75030",
  "notes": "Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log).",
  "recommended_fix": "treat rate==0 entries as invalid (return false / skip)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored after source-level verification; cannot be validated on this guest (no AMD GPU; radeon.ko cannot attach). Compiling the module or booting a patched kernel would not exercise the path without hardware.",
  "fix_evidence": "fix.diff (unified, against read-only sys/ tree; never applied)"
}