DF-3857 / manifest.json
{ "finding_id": "DF-3857", "title": "Divide-by-zero in dce_v10_0_latency_watermark: divides by available_bandwidth/disp_clk before any guard (DF-3828 DCE11 twin)", "verdict": "not_reproduced (kernel reach hardware-gated; arithmetic #DE primitive proven 3/3 on guest)", "impact_ceiling": "dos via kernel panic (local, unprivileged DRM client, Tonga/Fiji with zero default clocks)", "reproduce": { "build": "vm.sh run_root 'cc -O2 -Wall -o /tmp/wm_div0 /tmp/wm_div0.c'", "run": "vm.sh run_root '/tmp/wm_div0; echo exit=$?'", "expected": "SIGFPE exit=136 with zero clocks; healthy control returns 2297" }, "kernel_refs": [ "sys/dev/drm/amd/amdgpu/dce_v10_0.c:882", "sys/dev/drm/amd/amdgpu/dce_v10_0.c:883", "sys/dev/drm/amd/amdgpu/dce_v10_0.c:884", "sys/dev/drm/amd/amdgpu/dce_v10_0.c:892", "sys/dev/drm/amd/amdgpu/dce_v10_0.c:1024", "sys/dev/drm/amd/amdgpu/dce_v10_0.c:1038", "sys/dev/drm/amd/amdgpu/dce_v10_0.c:2064", "sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:677", "sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:718" ], "artifacts": [ "README.md", "VERDICT.md", "wm_div0.c", "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "env.txt", "fix.diff", "verdict.json", "manifest.json" ], "code_hash": "97896cbfbab8e03c228902ab360fe5b2c2a64c96f6dfb68a31cb2f7861b8fff8" } |