Divide-by-zero and OOB read in umcs7840_calc_baudrate when rate==0

Summary

umcs7840_calc_baudrate(0...) does not reject rate==0. Search loop falls through with i==8 then line 1066 evaluates umcs7840_baudrate_divisors[9]/0 - 1-element OOB read of 9-entry array immediately followed by integer divide-by-zero. On x86 idiv traps #DE kernel panics. ucom framework treats c_ospeed==0 as valid (usb_serial.c:1671) and every sibling serial driver rejects speed 0 in pre_param; umcs7840_pre_param instead calls calc_baudrate and panics. Primary trigger: hw.usb.ucom.cons_baud=0 loader tunable USB console bypasses tty.c ispeed normalization. Unprivileged local ioctl path currently fortuitously blocked by tty.c c_ispeed normalization but fragile defense.