# DF-3910 — Verification Verdict

**Status:** inconclusive (reproduced=0)
**Impact:** none on guest (no AMD GPU); userspace harness faults exactly as predicted
**Confidence:** certain (source-level; arithmetic fault demonstrated)

## Finding
`tonga_thermal_setup_fan_table()` divides by VBIOS-supplied temperature
deltas with no zero check:
```
t_diff1 = usTMed - usTMin;            tonga_smumgr.c:2502
t_diff2 = usTHigh - usTMed;           :2504
slope1 = (50 + ((16*duty100*pwm_diff1)/t_diff1)) / 100;   :2512  <-- div by 0
slope2 = (50 + ((16*duty100*pwm_diff2)/t_diff2)) / 100;   :2513  <-- div by 0
```
usTMin/usTMed/usTHigh come straight from ATOM_Tonga_Fan_Table /
ATOM_Fiji_Fan_Table (process_pptables_v1_0.c:941-946 / 978-982) with no
validation. Guards present: MicrocodeFanControl cap (:2472), bNoFan (:2476),
fan_table_start (:2482), duty100==0 (:2492) — none check the deltas.

## Verification
- Source chain certain (above).
- Guest run (run.log): the identical expression with usTMed==usTMin raises
  SIGFPE ("Illegal instruction (core dumped)", rc=132) — the userspace
  analogue of the kernel #DE panic. Kernel-path execution requires
  Tonga/Fiji hardware (absent — env.txt), hence inconclusive, matching the
  DF-1274 precedent (the SCLK/MCLK SS div0 twin, poc status inconclusive).

## Fix validation
Guard added after the t_diff2 computation: zero delta → unset
MicrocodeFanControl, return 0 (identical to the accepted fiji fix DF-1325).
Batch nativekernel rebuild on guest: tonga_smumgr.c compiled `-Werror`
clean, kernel rc=0 (fix_build.log). fix_status = **fixed**
(compile-validated).

## Distinct from knowns
DF-1274 = spread-spectrum rates (speed_spectrum_rate==0) at :591/:883 —
different inputs, different sites; fan-table slopes were not covered.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.