{
  "finding_id": "DF-4290",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "asic_internal_ss_get_ss_asignment() returns success with speed_spectrum_rate copied raw from the VBIOS (ppatomctrl.c:1248) and then integer-divided by 100 for table rev >= 2.2/3 (ppatomctrl.c:1253) \u2014 so both an explicit usSpreadRateInKhz of 0 and any value < 100 produce rate == 0 with return code 0 (success). Every consumer divides by this value with no zero check: ci_smumgr.c:345-346 (ref_clock*5/(ref_divider*rate)), ci_smumgr.c:1085, iceland_smumgr.c:849 and :1131, fiji_smumgr.c:914 \u2014 kernel integer divide-by-zero (Fatal trap 0: divide error) panic during SMC table construction at driver attach (CWE-369). Single-point fix at the producer: fail the lookup when the rate is unusable. Crafted-VBIOS threat model, Medium (panic band, same as DF-1497). Not runnable on this guest (no AMD dGPU \u2014 env.txt); trace-certain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (producer/consumer trace with all division sites); README.md; fix.diff (zero-rate rejection at the getter); env.txt",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1248",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1253",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:345",
    "sys/dev/drm/amd/powerplay/smumgr/ci_smumgr.c:1085",
    "sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c:849"
  ],
  "poc_changes": "n/a \u2014 no AMD dGPU on guest; code-trace evidence pack",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "notes": "Hardware-absent case (DF-1497/1498 precedent). SS caps gating: PHM_PlatformCaps_{Engine,Memory}SpreadSpectrumSupport from the VBIOS powerplay table.",
  "recommended_fix": "Reject SS assignments whose computed speed_spectrum_rate is 0 (return not-found) in asic_internal_ss_get_ss_asignment",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline behavior not reproducible on this guest (no AMD dGPU) -> no fixed-kernel build possible. fix.diff authored from trace.",
  "fix_evidence": "findings/poc/DF-4290/fix.diff (not applied to sys/; authored post-verification from line-accurate trace)"
}