# DF-3810 — VERDICT

**status: untested** (poc enum) / not testable on this guest — no Intel GPU.

## What was verified (source-level)
1. Division at intel_ddi.c:1363 `return dco_freq / (p0 * p1 * p2 * 5);` with no
   preceding zero check in `skl_calc_wrpll_link` (whole function read:
   intel_ddi.c:1306-1364).
2. p1 is the only operand that can be zero: QDIV_RATIO is an 8-bit field
   (`DPLL_CFGCR2_QDIV_RATIO_MASK (0xff << 8)`, i915_reg.h:9319) read raw when
   `DPLL_CFGCR2_QDIV_MODE(1)` (bit 7) is set; ratio==0 leaves p1==0 and no case
   remaps it. p0==0 hits `case DPLL_CFGCR2_PDIV_1` (encoding 0, i915_reg.h:9330)
   → p0=1; p2's four encodings (0..3, i915_reg.h:9324-9327) all map nonzero.
3. The CNL sibling guards exactly this (`WARN_ON(p0 == 0 || p1 == 0 || p2 == 0)`,
   intel_ddi.c:1424), proving the maintainers consider the state reachable
   enough to guard — SKL was simply missed. HSW sibling = known DF-1226
   (excluded from this report); this is the distinct SKL function.
4. Reachability: `skl_ddi_clock_get` (intel_ddi.c:1609-1656) calls it whenever
   `DPLL_CTRL1_HDMI_MODE(pll_id)` is set during config readback
   (`intel_ddi_clock_get` ← `intel_ddi_get_config` ← encoder->get_config),
   i.e. boot-time hw-state sanitize and CRTC state reads.
5. The driver's own DPLL programming never emits QDIV_MODE=1 with ratio 0
   (intel_dpll_mgr.c:1214-1215, 2206-2207), so the divide-by-zero requires
   firmware/BIOS-leftover or faulted register content — matching the
   Low/"anomalous state" rating, consistent with how DF-1226 was rated.

## Why not run
No Intel display hardware on the guest; a synthetic register value cannot be
injected into a real DPLL_CFGCR2 readback without the hardware.

## Fix
```diff
--- a/sys/dev/drm/i915/intel_ddi.c
+++ b/sys/dev/drm/i915/intel_ddi.c
@@ -1360,6 +1360,10 @@ static int skl_calc_wrpll_link(struct drm_i915_private *dev_priv,
 	dco_freq += (((cfgcr1_val & DPLL_CFGCR1_DCO_FRACTION_MASK) >> 9) * 24 *
 		1000) / 0x8000;
 
+	if (WARN_ON(p0 == 0 || p1 == 0 || p2 == 0))
+		return 0;
+
 	return dco_freq / (p0 * p1 * p2 * 5);
 }
```
(Mirrors cnl_calc_wrpll_link's guard at intel_ddi.c:1424.)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)