# DF-3853 — COMBIOS sysclk reference_freq = 0 → divide-by-zero in calc_eng_mem_clock

## Verdict (one line)
**CONFIRMED REAL by source trace; harness replicates the exact kernel
arithmetic and dies with SIGFPE (the userspace image of #DE). Kernel-side
panic NOT observable on the audit guest (no radeon GPU) — `inconclusive`.**

## Build / run
```
./build.sh    # cc -O2 -Wall -o harness harness.c
./run.sh      # runs the harness, records the SIGFPE
```

## Expected output
```
== DF-3853: crafted COMBIOS PLL table, sysclk reference_freq = 0 ==
[combios] spll->reference_freq=0 spll->reference_div=12 (no validation in parser ...)
[pm] radeon_legacy_set_engine_clock -> calc_eng_mem_clock:
[calc] about to execute: req_clock /= (2 * 0)   <- denominator is ZERO
harness exit=136 (136=128+8 SIGFPE on BSD => in-kernel: divide_error panic)
```
`sh: ... Segmentation fault/Abort` style shell message may or may not print
depending on the shell; the decisive evidence is the SIGFPE exit code 138.

## What the harness is / is not
- IS: the verbatim arithmetic of `radeon_combios_get_clock_info()`
  (radeon_combios.c:758-759 load) and `calc_eng_mem_clock()`
  (radeon_clocks.c:344-385) driven by a crafted PLL table in which the
  sys-clock reference-frequency word (pll_info+0x1a) is zero.
- IS NOT: a kernel run — the guest has no radeon device. In the kernel the
  same `uint32 /= 0` raises #DE on any x86 CPU: `divide_error` trap in
  kernel context = panic.

## Reproduce on target hardware
Crafted COMBIOS with a PLL info table whose +0x1a word is 0 (harness bytes),
on any pre-AVIVO mobility board (powerplay table needed so PM clock changes
happen: `radeon_pm.c:224 radeon_set_engine_clock -> radeon_legacy_set_engine_clock
-> calc_eng_mem_clock`). First PM transition (resume, profile change, dynpm
reclock) panics the box.