# DF-4331 — VERDICT

**Status: reproduced (certain). Impact: kernel panic (trap 18, #DE).**

## Root cause

`mr_update_span_set` divides by the firmware-supplied quad `diff`
(`mrsas_fp.c:969`) with no zero check, unlike every IO-time consumer of the
same field (`mrsas_fp.c:390-393` `mr_spanset_get_span_block`,
`:1431-1434` `MR_GetSpanBlock` — both explicitly set `*div_error = 1` and
bail). The function runs at RAID-map validation time, i.e. at adapter attach
(`mrsas.c:1762`, gated only on fw `supportUnevenSpans`) and again on every AEN
map update (`mrsas.c:2961`). Two more unguarded fw divisors exist on the
UnevenSpan IO path: `get_arm` (`:599`, `mega_mod64(stripe, SPAN_ROW_SIZE(...))`
— `spanRowSize` fw `u_int8_t`) and `mr_spanset_get_phy_params`
(`:653-654`, RAID-6 branch, same `SPAN_ROW_SIZE` divisor). The non-spanset
twin `MR_GetPhyParams` *does* guard `rowSize == 0` and `modFactor == 0`
(`:1359-1370`) — the guards were simply never added to the spanset copy.

## Reproduction

Same probe as DF-4330 (unmodified guest `mrsas_fp.c`, symbol-renamed,
`MR_ValidateMapInfo` entry). Map crafted with `quad[0].diff = 0`:

```
fp_probe: calling real MR_ValidateMapInfo() (spanDepth=1 quad[0].diff=0) ...
Fatal trap 18: integer divide fault while in kernel mode
kernel: type 18 trap, code=0
Stopped at probe_mr_update_span_set.part.0+0x1d7:  divq %rcx,%eax
```

(`panic.txt`, `serial_decisive.log` — serial console; guest wedged in ddb,
`vm.sh status` ⇒ down right after.) The faulting instruction is the compiled
`mega_div64_32(((quad->logEnd - quad->logStart) + quad->diff), quad->diff)`
at source line 969. On real hardware a firmware image (or PCIe DMA attack)
delivering `diff = 0` for any live quad bricks the machine at boot or on the
first config-change AEN — a persistent boot-time DoS.

## Fix validation

`fix.diff` (shared with DF-4330) validates every live quad `diff != 0` (and
`spanRowSize != 0` for RAID 0/5/6) inside `MR_ValidateMapInfo` before
`mr_update_span_set` is called. Patched probe, mode 2:
`nexus0: invalid RAID map geometry (ld/span/quad), rejecting map`,
`MR_ValidateMapInfo returned 1`, **no panic**, guest stays up
(`../DF-4330/fix_run.log`); benign mode-0 map still accepted (no regression).

## Exploit chain

None — pure availability. (DoS bucket.)

## Artifacts

`panic.txt`, `run.log` (panic run), `serial_decisive.log`, shared probe
sources (`fp_probe.c`, `rename.h`, `Makefile`, `build.sh`), `fix.diff`,
`build.log`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.