# DF-4228 — VERDICT

**Status: untested** (kernel-side panic not exercisable on this guest —
the poll thread exists only after the driver attaches to hardware, which
requires a Cypress APA trackpad on SMBus addr 0x67; the arithmetic fault
itself is demonstrated by harness and is source-certain).

## Root cause (line-accurate)
- `cyapa_idle_freq` / `cyapa_slow_freq` / `cyapa_norm_freq` are static ints
  exported read-write at cyapa.c:227-235 (`SYSCTL_INT(..., CTLFLAG_RW, ...)`)
  with no range enforcement — `debug.*` sysctls are root-writable.
- `cyapa_poll_thread` (cyapa.c:1161) unconditionally computes
  `(hz + freq - 1) / freq` at cyapa.c:1200 each iteration.
- `freq` is refreshed from the sysctl globals at cyapa.c:1202-1210
  (idle freq chosen whenever `sc->count == 0` — i.e. with *no* open fd,
  slow when idle, norm otherwise).
- freq = 0 ⇒ integer division by zero in kernel thread context ⇒ x86-64
  #DE exception in CPL0 ⇒ kernel panic.

## What ran on the guest
1. `model_div0.c` — identical expression `(hz + freq - 1) / freq` with the
   identical types (`int hz`, `int freq`), freq=0: SIGFPE on the division
   (run.log: "RESULT: SIGFPE - integer division by zero raised").
2. Module lifecycle (run.log, shared with DF-4227 pack):
   - `kldload cyapa.ko` → `debug.cyapa_*` sysctls appear (registered at
     module load, device or not).
   - `sysctl debug.cyapa_norm_freq=0` accepted → guest stayed up, because
     `cyapa_poll_thread` was never started (no attach). This confirms the
     write path works and only the hardware-gated thread is missing.

## Impact
Root-only trigger (`debug.*` sysctl write), but it is a one-syscall
deterministic kernel panic on any machine with the trackpad (Acer C720
class laptops). Low severity, DoS class.

## Recommended fix
Clamp before the division (and ideally validate on sysctl write):
```c
if (freq < 1)
        freq = 1;
```
See fix.diff (applies clean against sys/).

## Fix validation
Not possible on this guest (poll thread unreachable). fix_status =
not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.