{
  "finding_id": "DF-3857",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain divide-by-zero in the DCE10 display watermark math, the direct DF-3828 (DCE11) twin: dce_v10_0_latency_watermark() divides by available_bandwidth at dce_v10_0.c:882-883 and by wm->disp_clk at :884, all before the functions only guard (num_heads==0, :892, itself dead via the caller gate at :1024) and with no divisor validation anywhere on the caller chain (mode set -> dce_v10_0_crtc_do_set_base :2064 -> dce_v10_0_bandwidth_update :1145 -> program_watermarks :1013). Zero inputs traced end-to-end: with DPM disabled, wm.yclk/wm.sclk come from adev->pm.current_mclk/current_sclk (:1038-1039, :1077-1078), seeded from VBIOS ulDefaultEngineClock/ulDefaultMemoryClock with no zero-guard (amdgpu_atombios.c:677-680) and assigned even on parse failure (:718-719) - identical to the DF-3828 seeding; one zero term collapses dce_v10_0_available_bandwidth (:825-833) to 0 and the divide takes #DE -> kernel panic. The mode->clock==0 secondary vector is killed in this tree by drm_mode_validate_basic (drm_modes.c:1114, MODE_CLOCK_LOW). Arithmetic primitive proven on the guest: exact replica of the bandwidth/watermark math traps SIGFPE (exit=136, signal 8 = #DE, dmesg-confirmed) 3/3 runs while the healthy-clock control returns normally. Kernel-path reproduction impossible on this guest - 0 AMD PCI devices (vendor=0x1002 count 0), no /dev/dri (env.txt), amdgpu never binds - hence not_reproduced for the kernel reach; impact ceiling on Tonga/Fiji hardware in the affected state: local DoS via panic by an unprivileged DRM client mode set.",
  "exploit_chain": "unprivileged user with /dev/dri/card0 access -> drm_mode_setcrtc -> dce_v10_0_crtc_do_set_base (dce_v10_0.c:1822) -> dce_v10_0_bandwidth_update (:2064/:1145) -> dce_v10_0_program_watermarks -> dce_v10_0_latency_watermark -> divide by available_bandwidth==0 -> #DE -> kernel panic. Precondition: pm.current_sclk or current_mclk == 0 (VBIOS zero default clocks or failed firmware-info parse with DPM off). Memory-safety impact: none (pure div0 DoS).",
  "evidence": "run.log (SIGFPE exit=136 twice + healthy control); run.2.log (3rd trap + dmesg exited on signal 8 3/3 + guest /tmp cleanup); VERDICT.md (full chain incl. killed mode->clock/src_width vectors and the dce_v11-template bounds negatives); env.txt (no AMD ASIC on guest); fix.diff (git-apply-clean)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:882",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:883",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:884",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:892",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:1024",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:1038",
    "sys/dev/drm/amd/amdgpu/dce_v10_0.c:2064",
    "sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:677",
    "sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:718",
    "sys/dev/drm/drm_modes.c:1114"
  ],
  "poc_changes": "Authored from scratch, modeled on the DF-3828 pack (no seed provided by orchestrator). Inputs via argv to defeat constant folding; dce_v10_0 line numbers and dram-channel math (cik_get_number_of_dram_channels family) adapted from this file.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 210,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root cc -O2 -Wall -o /tmp/wm_div0 /tmp/wm_div0.c",
  "run_cmd": "vm.sh run_root /tmp/wm_div0; echo exit=$? (plus control and dmesg probes; /tmp cleaned)",
  "code_hash": "97896cbfbab8e03c228902ab360fe5b2c2a64c96f6dfb68a31cb2f7861b8fff8",
  "notes": "Pass-2 checklist item (DF-3828 twin) for dce_v10_0.c. num_heads==0 guard placement confirmed dead via caller gate at :1024 (structural note, not a separate finding). dce_v11-template negatives (hpd/audio/crtc-array bounds) all verified clean in VERDICT.md; latent pageflip crtcs[] read-before-check :3114 killed by the amdgpu_irq dispatch contract (amdgpu_irq.c:356, :414-432).",
  "recommended_fix": "Bail out of dce_v10_0_latency_watermark when available_bandwidth or wm->disp_clk is 0 (mirroring the num_heads==0 return), and zero-guard ulDefaultEngineClock/ulDefaultMemoryClock seeding in amdgpu_atombios_get_clock_info",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff guards both divides plus the VBIOS zero-clock seeding and is git-apply-clean against the read-only sys/ tree; a patched-kernel build cannot be exercised on this guest (no AMD ASIC, amdgpu never attaches, no observable kernel behavior difference), so hardware fix validation is not_testable here",
  "fix_evidence": "fix.diff; VERDICT.md; env.txt (hardware gate)"
}