# DF-3788 — verdict

**REPRODUCED** | reproduced=1 | impact=dos | confidence=certain

REPRODUCED at source level: the exact expression from bktr_core.c:3344-3346 with the PoC parameters compiles and raises SIGFPE (rc=136) on the DragonFly guest - in the kernel the same #DE is a panic.

## Root cause (citations)
BT848_SCAPAREA (bktr_core.c:1758-1771) copies the user-supplied capture
area verbatim (no >0 / bounds checks) and sets capture_area_enabled=TRUE.
The next capture start runs build_dma_prog(), whose horizontal-delay
computation divides by (capture_area_x_size * fp->hactive)
(bktr_core.c:3344-3346). With x_size = 0 the denominator is zero -> #DE
integer-divide trap -> kernel panic. (The earlier HSCALE expression at
3320-3325 divides by scaled_htotal/cols, both nonzero, so execution reaches
the faulting divide.) Unprivileged local DoS on any machine with the driver:
/dev/bktr0 is 0444.

## Guest reality (why no runtime kernel trigger)

The audit guest is DragonFly 6.5-DEVELOPMENT x86_64 (X86_64_GENERIC). The bktr
driver is NOT compiled into the GENERIC kernel (`sys/conf/files`: `optional
bktr pci`), there is no /boot/modules tree, no /dev/bktr*, /dev/tuner*,
/dev/vbi* nodes, no Brooktree PCI device (QEMU has no Bt848/Bt878 device
model; `pciconf -lv` shows no vendor 109e). Therefore the kernel code path is
unreachable ON THIS GUEST. Verification is source-level: faithful harnesses of
the exact kernel arithmetic (the same methodology as the accepted DF-1216
evidence pack), run on the DragonFly guest with its native cc, plus fix.diff
compile-validation against the guest's /usr/src. All PoC triggers compile
cleanly against the guest's kernel headers (poc_build_and_device_check.log).


## Exploit chain
open /dev/bktr0 (0444) -> BT848_SCAPAREA{x_size=0} -> METEORCAPTUR -> build_dma_prog divide-by-zero -> panic.

## Decisive evidence
run.log: denominator 0*754=0 then 'Floating point exception' rc=136.

## Fix validation
fix.diff (in this directory) applies cleanly against the pristine sys/ tree
(`git apply --check`) and compiles as part of the bktr KLD module on the
guest's /usr/src with -Werror together with the seven other pass-2 bktr fixes
(fix_build.log, MAKE_RC=0, bktr.ko + bktr_mem.ko produced). Runtime
patched-behavior validation is not possible on this guest (no device), hence
fix_status=not_testable (compile-validated + logic-reviewed).

## Kernel references
- sys/dev/video/bktr/bktr_core.c:1758
- sys/dev/video/bktr/bktr_core.c:1766
- sys/dev/video/bktr/bktr_core.c:3345

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.