DragonFlyBSD Kernel Audit
← dashboard
DF-0375

red_drops divides by fs->lookup_step taken verbatim from user config: panic when lookup_step==0

Summary

red_drops(:885): t=(curr_time-q->q_time)/fs->lookup_step in empty-queue branch. fs->lookup_step assigned directly from user ioc_fs->lookup_step at config_red(:1369) with no zero check. Configure RED flowset lookup_step=0, send packet to populate q->avg, drain queue, send second packet -> div by zero panic in hot path. Distinct crash site from DF-0374.