# DF-4126 — Inverted error check at rv6xx_dpm_init:1957-1969 — ATOM-computed SPLL/MPLL reference divider used only when radeon_atom_get_clock_dividers FAILS, default used on success

- File: sys/dev/drm/radeon/rv6xx_dpm.c
- Lines: 1957-1969   Severity: Low   Confidence: certain
- Status: inconclusive (impact: none) — hardware-gated crafted-VBIOS/firmware threat model;
  source-level certainty, no GPU in guest.

## Summary
Both clock-divider probes in rv6xx_dpm_init() test `if (ret)` where
every sibling dispatch tests success:
  rv6xx_dpm.c:1957-1962 (SPLL):
    ret = radeon_atom_get_clock_dividers(..., &dividers);
    if (ret)  pi->spll_ref_div = dividers.ref_div + 1;   <- taken on FAILURE
    else      pi->spll_ref_div = R600_REFERENCEDIVIDER_DFLT;
  rv6xx_dpm.c:1964-1969 (MPLL): same inverted shape for mpll_ref_div.
On SUCCESS the ATOM-computed divider is discarded and the default (4) is
used; on FAILURE the callee-zeroed dividers are consumed
(radeon_atombios.c:2838 memsets dividers), yielding ref_div+1 = 1. The value
is programmed into the PLL: r600_engine_clock_entry_set_reference_divider(
step, pi->spll_ref_div - 1) at rv6xx_dpm.c:187-188 (programs 0 on the
failure branch) and folds into the feedback divider at :184 — wrong SPLL/MPLL
programming (display/GPU instability) from VBIOS-dependent atom behavior.
rv6xx instance of the DF-3976/DF-4119 family (last member).

## Reproduce
No runnable kernel PoC: requires RV6xx/i915 hardware. See VERDICT.md for the full line-by-line source trace and fix.diff for the validated patch.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64