# DF-3869 VERDICT

**Status: inconclusive (hardware-gated)** — the guest has no AMD GPU (virtio-only
QEMU), so the in-kernel path cannot be executed here. The *arithmetic* that
produces the zero divisor was reproduced exactly, on the guest, with
kernel-verbatim fixed-point code (`run.log`).

## What was proven (run.log, guest uname in file)

- `bw_calcs()` is reachable from unprivileged mode-set on DCE110/112 DC:
  DRM_IOCTL_MODE_ATOMIC with a user mode blob →
  `drm_atomic_set_mode_prop_for_crtc` → `drm_mode_convert_umode` →
  `drm_mode_validate_basic` (drm_modes.c:1103-1120: only clock≠0 and
  hdisplay≤hsync_start≤hsync_end≤htotal) → amdgpu_dm
  `fill_stream_properties_from_drm_display_mode` (amdgpu_dm.c:2678,2689 —
  `h_total = crtc_htotal`, `pix_clk_khz = crtc_clock`, no zero/degeneracy
  checks) → `dc_validate_global_state` (dc_resource.c:2079) →
  `resource_build_scaling_params_for_context` (dc_resource.c:2133) →
  `dce110_validate_bandwidth`/`dce112` (dce110_resource.c:857-870) →
  `bw_calcs` (dce_calcs.c:2985).
- Constructed input: mode 1x16 htotal=3 clock=25 MHz; plane src 128x4 →
  dst 2x3. All DRM-core checks pass (harness step [1]).
- viewport 64x21 ≥ 16 → `resource_build_scaling_params` returns true
  (dc_resource.c:1125) so `bw_calcs` is reached (harness step [2]).
- hsr = 64 exactly (24.24 word 1073741824), vsr = 22369600 ≤ frc(4/3)
  (harness step [3]); branch guards at dce_calcs.c:804 (vsr>1 → prefetch=0)
  and :817-834 (lb_lines_mid = 4/3 ∉ {2,4}) hold → the `else` at :838 runs.
- **dce_calcs.c:839 divisor = `bw_div(h_total + (src_width−256)/hsr, 2)`
  = bw_div(3<<24 + (−3<<24), 2) = 0 EXACTLY** (harness steps [5][6]).
- In-kernel consequence: `bw_div(x, 0)` → `bw_frc_to_fixed(x, 0)`
  (bw_fixed.h:121-124, bw_fixed.c:57): `ASSERT(denominator != 0)` is only
  `WARN_ON` in release (os_types.h:72-77), then `div64_u64_rem(n, 0, &rem)`
  (math64.h:76-80, plain C `%`) → CPU #DE in kernel → trap_fatal → panic.
  Userland analogs both fired SIGFPE (harness steps [7][9]).

## Why the other big divisors are NOT zero (negative results with weight)

- `pixel_rate`/`h_total` can never be 0: drm core `drm_mode_validate_basic`
  rejects clock==0 (MODE_CLOCK_LOW) and hdisplay==0 with htotal≥hsync_end
  (drm_modes.c:1114-1120); `pix_clk_khz*=2` for frame packing keeps ≠0.
- `hsr`/`vsr` can never be 0 on the reachable path: amdgpu_dm
  `fill_rects_from_plane_state` rejects zero src/dst extents (amdgpu_dm.c:2439-2459);
  `calculate_scaling_ratios` truncates ratios to 19 fractional bits
  (dc_resource.c:747-753) which *could* zero a ratio < 2^-19, but the
  `viewport ≥ 16` gate (dc_resource.c:1125) with clip ≤ 16384 bounds
  ratio ≥ 16/16384 = 2^-10 > 2^-19. Killed.
- OOB in `populate_initial_data`: max write index = num_displays+4 ≤ 9
  (≤6 streams) < `maximum_number_of_surfaces` = 12 (dce_calcs.h:233);
  watermark[9] reads in-bounds. Killed.
- No VBIOS mem_latency/num_states walk exists in this file (that is
  dcn_calcs.c); all vbios/dceip data here are compile-time constants except
  `asic_id.vram_width` (→ DF-3870).
- No recursion; single kzalloc'd `bw_calcs_data`; deterministic.

## Sink 1945 (secondary, likely not certain)

`min_stutter_dmif_buffer_size` (u32, dce_calcs.h:359) is set at :1939 via
truncating `bw_fixed_to_int()`; a stutter_dmif_buffer_size in (0,1) yields 0
and :1945 divides u32/u32 → `divl` #0 → #DE. Degenerate timings shrink the
product below 1; full-chain emulation not performed (the formula depends on
the entire watermark model), so recorded as likely, same root cause family.

## Bottom line

Source-certain: an unprivileged user with a DRM master/_modeset on a DCE
display can drive `calculate_bandwidth()` into an exact-integer zero divisor
at dce_calcs.c:839 → kernel #DE panic. Hardware-gated (no AMD GPU on guest),
hence inconclusive runtime verdict; arithmetic proven exactly on the guest.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.