{
  "finding_id": "DF-3810",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "skl_calc_wrpll_link() (intel_ddi.c:1363) divides by p0*p1*p2*5 with no zero guard, unlike its CNL sibling cnl_calc_wrpll_link() which explicitly WARNs and returns 0 (intel_ddi.c:1424-1425) for the same fields. p1 can be zero: when DPLL_CFGCR2_QDIV_MODE(1) is set the 8-bit QDIV_RATIO field is used raw. The drivers own PLL programming never writes ratio 0 (intel_dpll_mgr.c:1214-1215), so triggering requires BIOS/firmware-leftover or faulted DPLL_CFGCR2 content read back during state sanitize; on such state the kernel takes an integer-divide exception and panics. Not executed: guest has no Intel GPU; the register cannot be synthesized without hardware.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3810/VERDICT.md (division + guard asymmetry proof), findings/poc/DF-3810/env.txt",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_ddi.c:1306",
    "sys/dev/drm/i915/intel_ddi.c:1322",
    "sys/dev/drm/i915/intel_ddi.c:1363",
    "sys/dev/drm/i915/intel_ddi.c:1424",
    "sys/dev/drm/i915/intel_dpll_mgr.c:1214"
  ],
  "poc_changes": "no PoC written; source-level analysis only (no trigger hardware)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 ... x86_64 (no i915)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Distinct function from DF-1226 (hsw_ddi_calc_wrpll_link p*r). SKL-variant guard omission; #DE panic class. Pass-2 finding.",
  "recommended_fix": "Add the cnl-style WARN_ON(p0==0||p1==0||p2==0) return-0 guard before the division in skl_calc_wrpll_link",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: baseline never reproduced (no hardware)",
  "fix_evidence": ""
}