# VERDICT — DF-3835

**status: inconclusive (arithmetic certain, hardware reachability inferred)** — reproduced: 0 —
guest impact: none.

## Arithmetic proof
Guard (if_bwn_phy_lp.c:2340): `if (ie.ie_ipwr + ie.ie_qpwr < 2) { ret = 0; goto done; }`

Take `ie_ipwr = 0`, `ie_qpwr = 2` (both are plain `uint32_t` register accumulations,
if_bwn_util.h / if_bwn_phy_lp.c:3529-3537): guard passes (sum = 2).

CALC_COEFF(tmp[0], _x=bwn_nbits(ie_iqprod), _y=ie_iqprod, _z=ie_ipwr=0) — lines 2308-2316:
  `_t = _x - 20;`
  - `_t >= 0`: `_v = ((_y << (30 - _x)) + (_z >> (1 + _t))) / (_z >> _t);`
    → `(_z >> _t)` = 0 → **idivl by zero** → x86 #DE → DragonFly kernel panic.
  - `_t < 0`: `... / (_z << -_t)` → `0 << k` = 0 → same.
CALC_COEFF2 (2317-2324) divides by `(_z >> _t)` / `(_z << -_t)` identically.

No other check on `ie_ipwr` exists anywhere between the register read (3532-3534) and the
macros.

## Reachability reasoning (why 'likely', not 'speculative')
- `bwn_phy_lp_rx_iq_est` returns 1 (estimator ran, 3518-3527) with all-zero or asymmetric
  accumulators whenever the PHY's IQ estimator block is misconfigured or the I-path is
  physically dead — the estimator counter register just accumulates 0.
- The call is made while the RX front-end is forced into an artificial override state
  (trsw_over TX=1 RX=0 at 735, forced RF_OVERRIDE_0 0x800 at 748-749) — precisely the regime
  where a marginal radio reads pathological values.
- It runs at every `bwn_phy_lp_init` (line 482) and every 60 seconds
  (`bwn_phy_lp_task_60s` → `bwn_phy_lp_calib` → line 752; the driver even marks the ignored
  return value `/* XXX no checking return value? */` at 751) — so one occurrence bricks the
  system repeatedly.
- Not software-reachable: no user input reaches `ie_ipwr`; requires the radio to actually
  report 0 I-power. Fault-injection on the PCIe device (a compromised b43 firmware/dongle
  attack) would make it deterministic.

## Guest
No Broadcom wireless hardware (env.txt) — bwn never attaches; path untestable there.

## Fix
fix.diff extends the guard with `|| ie.ie_ipwr == 0` (git apply --check passes). Upstream
FreeBSD has the identical defect and needs the same guard.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.