DF-3622 VERDICT — divide-by-zero on zero MPLL reference clock

Bottom line

Real bug, source-certain; runtime inconclusive (no AMD GPU on guest).

ci_calculate_mclk_params() divides by adev->clock.mpll.reference_freq without checking it (ci_dpm.c:2977):

u32 reference_clock = adev->clock.mpll.reference_freq;   /* :2970 */
...
tmp = (freq_nom / reference_clock);                      /* :2977 — #DE if 0 */

The value is copied verbatim from the VBIOS FirmwareInfo table (usMemoryReferenceClock) at amdgpu_atombios.c:659-660 — with no zero fixup, in contrast to the neighboring pll_out_min fields that do get == 0 → 64800 corrections (:642-643, :668-670). A crafted VBIOS with usMemoryReferenceClock == 0 plus any parseable ASIC_InternalSS_Info header (needed for caps_mclk_ss_support, ci_dpm.c:6052-6056, which gates the divide) triggers the division at driver enable time.

freq_nom is memory_clock * 2|4 * (1 << post_div) and cannot be zero (mclk == 0 rejected at ci_dpm.c:3480-3481), so zero reference clock is an unconditional #DE → panic during ci_dpm_enable → ci_populate_all_memory_levels → ci_populate_single_memory_level → ci_calculate_mclk_params (called at ci_dpm.c:3107), i.e. at boot/bind and on every resume.

Note the sibling ci_calculate_sclk_params only ever multiplies by the SPLL reference clock — the mpll path is the only reference-clock divide in this file. (For completeness: ci_program_display_gap divides by refresh_rate, but that is guarded 0→60 at ci_dpm.c:2133-2134.)

Verification narrative

• Guest lacks any AMD ASIC → kernel path unexecutable → inconclusive; module presence verified (amdgpu.ko loads).
• The shared ci_ss_div0.c executed on the guest demonstrates sink [C]: the exact freq_nom / reference_clock division with usMemoryReferenceClock = 0 (run.log).
• Twin of si_dpm DF-3613.

Fix

fix.diff returns -EINVAL from ci_calculate_mclk_params when the mpll reference clock is zero (SS setup cannot be computed); enable then fails cleanly instead of panicking. Not testable on this guest.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.