{
  "finding_id": "DF-4228",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain divide-by-zero panic: (hz + freq - 1) / freq at cyapa.c:1200 with freq reloaded from unbounded root-writable RW sysctls (cyapa.c:227-235) at cyapa.c:1202-1210. Harness executing the identical expression with identical types raises SIGFPE on the guest (build.log/run.log). Kernel-side panic not exercisable on this guest because cyapa_poll_thread only starts after hardware attach (no SMBus controller/trackpad in QEMU; module loads and sysctl write of 0 was accepted without effect - see ../DF-4227/run.log). On trackpad hardware the trigger is one sysctl write.",
  "exploit_chain": "root: sysctl debug.cyapa_idle_freq=0 -> next cyapa_poll_thread iteration executes (hz+0-1)/0 -> #DE in kernel thread -> panic",
  "evidence": "build.log + run.log (harness SIGFPE, deterministic), VERDICT.md, fix.diff (applies clean)",
  "kernel_refs": [
    "sys/dev/smbus/cyapa/cyapa.c:227",
    "sys/dev/smbus/cyapa/cyapa.c:1200",
    "sys/dev/smbus/cyapa/cyapa.c:1202"
  ],
  "poc_changes": "n/a - pack authored fresh",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O0 -Wall -o model_div0 model_div0.c",
  "run_cmd": "./model_div0",
  "code_hash": "b75fe456df690e17294d996eeeadceb666be39ca71da341c27edcd98f65f017f",
  "notes": "impact field reflects what was observed on THIS guest (none); the source-certain impact on real hardware is a kernel panic (DoS). Root-only trigger (debug.* sysctl).",
  "recommended_fix": "clamp freq to >= 1 before the division (fix.diff) and validate the sysctls",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix requires the attached device to validate on hardware; the one-line clamp is line-accurate against the verified arithmetic and applies cleanly to sys/.",
  "fix_evidence": "findings/poc/DF-4228/fix.diff (git apply --check clean)"
}