# DF-4290 — SS getters emit success with `speed_spectrum_rate == 0` → integer divide-by-zero panic in clock-spread callers

Pass-2 finding for `sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c`
(the "(c) rate==0 div0 family" hinted by the pass-2 brief).

## The bug

`asic_internal_ss_get_ss_asignment()` copies the raw VBIOS rate into the
caller-visible struct and returns **success** without validating it
(ppatomctrl.c:1245-1254):

```c
if (entry_found) {
        ssEntry->speed_spectrum_percentage =
                le16_to_cpu(ssInfo->usSpreadSpectrumPercentage);
        ssEntry->speed_spectrum_rate = le16_to_cpu(ssInfo->usSpreadRateInKhz);   // :1248

        if (((GET_DATA_TABLE_MAJOR_REVISION(table) == 2) &&
            (GET_DATA_TABLE_MINOR_REVISION(table) >= 2)) ||
            (GET_DATA_TABLE_MAJOR_REVISION(table) == 3)) {
                ssEntry->speed_spectrum_rate /= 100;                             // :1253
        }
        ...
}
return entry_found ? 0 : 1;
```

* A VBIOS `usSpreadRateInKhz == 0` stays 0.
* For table revision ≥ 2.2 or 3, **any value < 100 truncates to 0**
  (`/=` integer division) — e.g. a legal-looking 30 kHz rate becomes 0.

The unvalidated value is then used as a **divisor** by every consumer:

| Consumer | Division | File:line |
|---|---|---|
| CI engine SS | `clk_s = ref_clock * 5 / (ref_divider * ss_info.speed_spectrum_rate)` | `sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:345-346` |
| CI memory SS | `clks = reference_clock * 5 / ss_info.speed_spectrum_rate` | `sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1085` |
| Iceland engine SS | `clkS = reference_clock * 5 / (reference_divider * ss_info.speed_spectrum_rate)` | `sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:849` |
| Iceland memory SS | same shape | `iceland_smumgr.c:~1131` |
| Fiji engine SS | `(ref_divider * ssInfo.speed_spectrum_rate)` divisor | `fiji_smumgr.c:914` |

(None of the callers checks for zero; the getter's `return 0` is taken as
"values are usable".)

Trigger: crafted VBIOS on a CI/Bonaire/Hawaii (ci), Topaz/Volcanic
(iceland), Fiji (or Tonga/VegaM analogues) dGPU that
(1) sets the `PHM_PlatformCaps_{Engine,Memory}SpreadSpectrumSupport` cap,
(2) provides an ASIC_InternalSS_Info entry matching the target clock with
`usSpreadRateInKhz == 0` (or < 100 on rev≥2.2 tables).
Result: integer divide-by-zero in kernel → `Fatal trap 0: divide error`
panic during SMC table construction at driver attach (CWE-369).

## Reproduce

Not runnable on this audit guest (no AMD dGPU — env.txt). On hardware the
trigger is purely VBIOS content; expected `Fatal trap 0: divide error`
faulting in `ci_program_display_gap`/`ci_populate_smc_*` clock-spread
setup paths.