{
  "finding_id": "DF-3835",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "bwn_phy_lp_calc_rx_iq_comp (sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2306) guards its hardware-derived IQ estimates with only ie.ie_ipwr + ie.ie_qpwr < 2 (line 2340) and then divides by expressions of ie.ie_ipwr inside CALC_COEFF/CALC_COEFF2 (macros at 2308-2324, invocations at 2345-2346): (_y << (30-_x)) / (_z >> _t) with _z = ie_ipwr. ie_ipwr == 0 together with ie_qpwr >= 2 satisfies the guard and produces a division by zero \u2014 x86 #DE, kernel panic. ie_ipwr/ie_qpwr are raw 32-bit accumulators read from the PHY IQ power registers (3529-3537), i.e. radio-state-controlled; a dead or muted I-path during the calibration override (trsw_over 1/0, RF_OVERRIDE forced at 748-749) plausibly yields exactly 0. Reachability: bwn_phy_lp_calib at init (482) and every 60 s via bwn_phy_lp_task_60s (610-614) \u2014 a radio in that state panics the host repeatedly. Arithmetic is certain; the hardware state is inferred, hence likely not certain. Not exercisable on the audit guest (no Broadcom PCI device, env.txt). Same defect exists in FreeBSD head (identical guard and macros).",
  "exploit_chain": "no privilege gain: LP-PHY radio fault/fault-injection (e.g. failing I-path LNA) -> ie_ipwr==0, ie_qpwr>=2 -> kernel divide-by-zero panic at init and every 60 s -> persistent local DoS until the radio state changes.",
  "evidence": "README.md (guard line 2340 vs divisors in macros 2308-2324; callers 482/610-614/752); env.txt; fix.diff (extend guard with ie.ie_ipwr == 0, git-apply --check passes)",
  "kernel_refs": [
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2340",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2345",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2346",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2308",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:2324",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:3529",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:610",
    "sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c:752"
  ],
  "poc_changes": "No PoC \u2014 the divisor comes from PHY hardware accumulators, not from any software-reachable input; would need LP PHY hardware fault injection.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-2 hunt item (c): calib/loop bounds \u2014 this is the arithmetic edge in the calibration math rather than a poll loop (the polls rx_iq_est:500x1ms and rxcal_r2:10000x1ms are bounded and were recorded as negative results).",
  "recommended_fix": "Extend the guard: if (ie.ie_ipwr + ie.ie_qpwr < 2 || ie.ie_ipwr == 0) before invoking the CALC_COEFF macros (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline #DE and patched behavior require an LP PHY reporting zero I-power; no Broadcom hardware on the audit guest (env.txt). fix.diff is git-apply-able (verified).",
  "fix_evidence": "fix.diff"
}