{
 "finding_id": "DF-3869",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Hardware-gated (guest has no AMD GPU): in-kernel path not executable here, but the zero divisor at dce_calcs.c:839 was proven EXACTLY on the guest with kernel-verbatim fixed-point arithmetic (run.log: divisor==0, both #DE analogs SIGFPE). An unprivileged DRM mode blob (1x16 htotal=3) + plane (src 128x4 -> dst 2x3) passes drm_mode_validate_basic, reaches bw_calcs on DCE110/112, and makes the line-839 outer bw_div divide by exactly 0 -> div64_u64_rem(n,0) -> kernel #DE panic. Secondary sink 1945 (u32 truncation -> 0 -> divl) is likely, same family.",
 "exploit_chain": "",
 "evidence": "run.log steps [5][6] divisor==0; [7]/[9] SIGFPE children; VERDICT.md reachability chain and killed negatives",
 "kernel_refs": [
  "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:839",
  "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:1945",
  "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:57",
  "sys/dev/drm/amd/display/dc/inc/bw_fixed.h:121",
  "sys/dev/drm/amd/display/dc/os_types.h:76",
  "sys/dev/drm/include/linux/math64.h:76",
  "sys/dev/drm/drm_modes.c:1103",
  "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:2678"
 ],
 "poc_changes": "harness written fresh (no seed): verbatim copies of bw_frc_to_fixed/dc_fixpt_truncate/fixed31_32_to_bw_fixed + the line-839 expression; fixed DCE of the faulting divisions by storing into volatile",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 12,
 "guest_dirty": 0,
 "build_cmd": "cc -O2 -o dce839_zero_div dce839_zero_div.c",
 "run_cmd": "./dce839_zero_div",
 "code_hash": "120e33c449e782061f113b9c3632d81bd0d2171a3958f727c33e8bc16e90e940",
 "notes": "Panics would only manifest on DCE110/112 hardware (amdgpu DC). DRM core does NOT forbid hdisplay=1/htotal=3; viewport>=16 gate satisfied (64x21). Sink 839 certain, sink 1945 likely.",
 "recommended_fix": "Guard zero denominators at dce_calcs.c:839 and :1945; harden bw_frc_to_fixed against divisor 0 (see fix.diff)",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff authored against read-only sys/; cannot build DCE kernel path on guest (no AMD HW)",
 "fix_evidence": "fix.diff"
}