# DF-3835 — bwn_phy_lp_calc_rx_iq_comp divides by hardware-controlled `ie_ipwr` that is only sum-guarded — kernel #DE panic from the 60-second calibration path

- File: `sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c` (pass 2)
- Class: CWE-369 divide-by-zero → kernel panic (DoS), hardware-state-gated
- Severity: Medium (panic; radio-dependent reachability), confidence: likely
- Upstream-inherited (FreeFreeBSD head has the identical guard and macros).

## Build / Run / Expected
Hardware-gated (env.txt: no Broadcom wireless on the audit guest). On hardware with an LP PHY,
any condition that makes the I-channel power accumulator read back 0 while the Q accumulator is
≥ 2 (dead/muted I-path, RX chain fault, aggressive front-end override during calibration) hits
the divide in the very next calibration cycle:

    # automatic: bwn_phy_lp_calib runs at init and every 60 s (bwn_phy_lp_task_60s)

Expected: `kernel trap 0 (divide error)` → panic.

## Root cause
`bwn_phy_lp_calc_rx_iq_comp` — if_bwn_phy_lp.c:2329-2346:

        ret = bwn_phy_lp_rx_iq_est(mac, sample, 32, &ie);
        if (ret == 0)
                goto done;
        if (ie.ie_ipwr + ie.ie_qpwr < 2) {   /* only the SUM is guarded */
                ret = 0;
                goto done;
        }
        CALC_COEFF (tmp[0], bwn_nbits(ie.ie_iqprod), ie.ie_iqprod, ie.ie_ipwr);
        CALC_COEFF2(tmp[1], bwn_nbits(ie.ie_qpwr),  ie.ie_qpwr,  ie.ie_ipwr);

Both macros divide by expressions of `_z = ie.ie_ipwr` (lines 2308-2324):
`... / (_z >> _t)` or `... / (_z << -_t)`. With `ie_ipwr == 0` (and `ie_qpwr >= 2`, which
passes the sum guard) the divisor is 0 → x86 #DE → kernel panic.

`ie.ie_ipwr`/`ie.ie_qpwr` are raw 32-bit accumulations read from
BWN_PHY_IQ_I_PWR_ACC_HI/LO registers after the estimator run (if_bwn_phy_lp.c:3529-3537) —
device-controlled values. The call sites are `bwn_phy_lp_calib` (if_bwn_phy_lp.c:752, comment
at 751 even flags the ignored return value) which runs from `bwn_phy_lp_init` (482) and from
the periodic `bwn_phy_lp_task_60s` (610-614), so a radio in this state panics the host
repeatedly (init + every 60 s).