{
  "finding_id": "DF-4425",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "not_reproduced: QEMU 7.2.22 refuses to construct the device (monitor probe: num-queues property must be larger than 0), so the trigger cannot be built with available tooling. The code path itself is certain: with VIRTIO_BLK_F_MQ negotiated (offered by VTBLK_FEATURES) and blkcfg.num_queues=0, virtio_blk.c:292 sets vtblk_nqs = min(0, ncpus) = 0 and :298 min(nqs, nintrs)=0; the vqmap loop at :323-326 then executes i % sc->vtblk_nqs = 0 % 0 on its first iteration -> integer divide exception -> kernel panic in vtblk_attach (boot-time panic when the boot disk presents this config). Device-controlled DoS, no memory-safety impact.",
  "exploit_chain": "",
  "evidence": "README.md (trace + live QEMU rejection output); virtio_blk.c:289-298, :323-326.",
  "kernel_refs": [
    "sys/dev/virtual/virtio/block/virtio_blk.c:292",
    "sys/dev/virtual/virtio/block/virtio_blk.c:298",
    "sys/dev/virtual/virtio/block/virtio_blk.c:325"
  ],
  "poc_changes": "n/a",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "QEMU monitor: device_add virtio-blk-pci,drive=...,num-queues=0  -> rejected by QEMU",
  "code_hash": "",
  "notes": "Same malicious-virtio-config family as DF-1603/DF-1604.",
  "recommended_fix": "if (virtio_with_feature(dev, VIRTIO_BLK_F_MQ) && blkcfg.num_queues < 1) return EINVAL; before the vqmap loop",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: baseline untriggerable on this rig (QEMU validates num-queues > 0)",
  "fix_evidence": ""
}