Summary

ar5416IQCalibration guards divisions with only if(powerMeasQ != 0) (line 98) but check is insufficient. iCoffDenom (line 95) = (powerMeasI/2 + powerMeasQ/2)/128 is zero whenever (powerMeasI/2 + powerMeasQ/2) < 128. qCoffDenom (line 96) = powerMeasQ/64 is zero whenever powerMeasQ in [1,63]. With either denominator zero kernel takes #DE trap (SIGFPE/kernel panic) at lines 100 or 101 during periodic IQ calibration. Guard at :98 incomplete: (a) powerMeasQ in [1,63] integer division /64 yields qCoffDenom==0 panics at :101 powerMeasI/qCoffDenom-64; (b) does not protect iCoffDenom at all so even when powerMeasQ large small powerMeasI (e.g. powerMeasI=0 powerMeasQ=200 -> iCoffDenom=(0+100)/128=0) panics at :100 iqCorrMeas/iCoffDenom. Any combination where (powerMeasI/2+powerMeasQ/2)<128 OR powerMeasQ<64 triggers trap. Values from OS_REG_READ of AR_PHY_CAL_MEAS_0/1 hardware PHY calibration measurement registers. Trigger: faulty/forged PCIe WiFi device or abnormal RF conditions (disconnected/damaged antenna weak signal during calibration window) drive small-but-nonzero power measurements. Calibration runs periodically whenever ath(4) up no privilege required. Impact: hard kernel panic full system DoS (#DE trap fatal kernel context x86) no memory corruption no info leak no priv-esc availability only.