# DF-4333 — hptmv `hpt_add_disk_to_array` divides by `(bArnMember - 1)` unchecked

File: `sys/dev/raid/hptmv/gui_lib.c:935`

```c
Capacity = pArray->VDeviceCapacity / (pArray->u.array.bArnMember - 1);
```

`bArnMember` is a `UCHAR`. `HPT_IOCTL_ADD_DISK_TO_ARRAY`
(`gui_lib.c:1364-1376`) reaches this line whenever the array is a *broken*
(`rf_broken`, `:915`) RAID 1/5 (`:917-918`). Arrays with `bArnMember == 1`
are constructible through `HPT_IOCTL_CREATE_ARRAY[_V2]` with `nDisk = 1`
(`gui_lib.c:571` bounds only `nDisk > MAX_MEMBERS`; `:614` `nDisk <= 2`
accepts 1; `:618` `bArnMember = pParam->nDisk`) — the same construction
already established by DF-1682 for the sibling site `ioctl.c:694`
(`hpt_rebuild_data_block`). `bArnMember == 1` ⇒ divisor `0` ⇒ x86 #DE ⇒
kernel panic.

Differences from DF-1682 (why this is a separate site, not a re-report):
DF-1682's division is in the *rebuild DPC* queued by `hpt_set_array_state`
(needs only `mIsArray` + `vf_online`); this one is in the ADD_DISK ioctl
itself and additionally requires `rf_broken` (`:915`) — reachable when a
degenerate 1-member RAID1/5 loses its member (blob failure path sets
`rf_broken` on the parent) or is restored from on-disk metadata with a broken
1-member config. Trigger therefore needs the HighPoint HBA plus a degraded
array state: **Low severity, sibling of DF-1682**.

## Guest status — NOT REPRODUCIBLE HERE

Same hardware absence as DF-4332 (`pciconf -l`: no 11AB devices;
`hw.hptmv.status` OID absent; without an adapter the path NULL-derefs before
gui_lib.c — known DF-1853). Verdict: **inconclusive — hardware absent**;
defect established by inspection.

## Fix direction (one line)

Reject `bArnMember < 2` before the division at `gui_lib.c:935`
(mirror of the fix DF-1682 needs at `ioctl.c:694`) — e.g.

```diff
-	Capacity = pArray->VDeviceCapacity / (pArray->u.array.bArnMember - 1);
+	if (pArray->u.array.bArnMember < 2)
+		return -1;
+	Capacity = pArray->VDeviceCapacity / (pArray->u.array.bArnMember - 1);
```

and bound `nDisk >= 2` for array creation in `hpt_create_array_v2`.