Kernel divide-by-zero panics from crafted RAID geometry (width/interleave/total_sectors == 0)

Summary

Multiple arithmetic sites in I/O path and status ioctl divide or modulo by raid geometry fields copied verbatim from attacker-controlled metadata never checked for zero. ata_raid_status :1028 total_sectors==0 divide-by-zero. ata_raid_strategy RAID0/RAID01 :359-361 divides by interleave and width both from metadata. RAID5 :366-373 same. ata_raid_attach :181 heads*sectors divisor. No parser validates width/interleave/total_sectors non-zero before softc attached and exposed for I/O.