# DF-4765 — divide-by-zero panic in `hpt_copy_array_info` rebuild/verify percentage (bArnMember==1 / tiny per-member capacity)

File: `sys/dev/raid/hptmv/hptproc.c` (pass 2)

## Build & run (same KLD harness as DF-4764)

    ./build.sh          # builds /root/h1/h1harness.ko on the guest
    kldload /root/h1/h1harness.ko
    sysctl h1harness.trigger=2     # baseline: panics (Fatal trap 18)
    # after reset + rebuild: sysctl h1harness.trigger=5  -> fix: survives

## Expected baseline (run.log)

    === H2 (DF-4765) bArnMember==1 -> div/0 ===
    H2: real RAID-1 array, bArnMember=1 rf_verifying=1
    Fatal trap 18: integer divide fault while in kernel mode
    Stopped at hpt_copy_array_info.constprop.3+0x187:  divq %rdi,%eax

## Why it is reachable

- `gui_lib.c:614` accepts `AT_RAID1` with `nDisk <= 2` — a 1-member mirror
  (`bArnMember = pParam->nDisk` = 1 at :618) is the create-and-duplicate
  starting state.
- `hptproc.c:182-183` lets the `verify start N` sysctl command run on any
  RAID-1/RAID-5 array regardless of member count.
- The percentage `ksprintf` at `hptproc.c:457/462` divides by
  `(VDeviceCapacity/(bArnMember-1))>>11` with no guard.
- The outer divisor is also 0 whenever per-member capacity < 2 MB.

Detonator: any local user reading `sysctl hptmv.status` (world-readable).
Precondition: hptmv hardware with such an array (absent from audit guest;
verified via verbatim-code harness — see VERDICT.md in DF-4764).

Fix: `fix.diff` F2 hunk (guarded divisor) — validated in-harness
(trigger 5 survives, prints `Verifying 0%`).