DF-3835 — bwn_phy_lp_calc_rx_iq_comp divides by hardware-controlled ie_ipwr that is only sum-guarded — kernel #DE panic from the 60-second calibration path

• File: sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c (pass 2)
• Class: CWE-369 divide-by-zero → kernel panic (DoS), hardware-state-gated
• Severity: Medium (panic; radio-dependent reachability), confidence: likely
• Upstream-inherited (FreeFreeBSD head has the identical guard and macros).

Build / Run / Expected

Hardware-gated (env.txt: no Broadcom wireless on the audit guest). On hardware with an LP PHY, any condition that makes the I-channel power accumulator read back 0 while the Q accumulator is ≥ 2 (dead/muted I-path, RX chain fault, aggressive front-end override during calibration) hits the divide in the very next calibration cycle:

# automatic: bwn_phy_lp_calib runs at init and every 60 s (bwn_phy_lp_task_60s)

Expected: kernel trap 0 (divide error) → panic.

Root cause

bwn_phy_lp_calc_rx_iq_comp — if_bwn_phy_lp.c:2329-2346:

    ret = bwn_phy_lp_rx_iq_est(mac, sample, 32, &ie);
    if (ret == 0)
            goto done;
    if (ie.ie_ipwr + ie.ie_qpwr < 2) {   /* only the SUM is guarded */
            ret = 0;
            goto done;
    }
    CALC_COEFF (tmp[0], bwn_nbits(ie.ie_iqprod), ie.ie_iqprod, ie.ie_ipwr);
    CALC_COEFF2(tmp[1], bwn_nbits(ie.ie_qpwr),  ie.ie_qpwr,  ie.ie_ipwr);

Both macros divide by expressions of _z = ie.ie_ipwr (lines 2308-2324): ... / (_z >> _t) or ... / (_z << -_t). With ie_ipwr == 0 (and ie_qpwr >= 2, which passes the sum guard) the divisor is 0 → x86 #DE → kernel panic.

ie.ie_ipwr/ie.ie_qpwr are raw 32-bit accumulations read from BWN_PHY_IQ_I_PWR_ACC_HI/LO registers after the estimator run (if_bwn_phy_lp.c:3529-3537) — device-controlled values. The call sites are bwn_phy_lp_calib (if_bwn_phy_lp.c:752, comment at 751 even flags the ignored return value) which runs from bwn_phy_lp_init (482) and from the periodic bwn_phy_lp_task_60s (610-614), so a radio in this state panics the host repeatedly (init + every 60 s).

VERDICT — DF-3835

status: inconclusive (arithmetic certain, hardware reachability inferred) — reproduced: 0 — guest impact: none.

Arithmetic proof

Guard (if_bwn_phy_lp.c:2340): if (ie.ie_ipwr + ie.ie_qpwr < 2) { ret = 0; goto done; }

Take ie_ipwr = 0, ie_qpwr = 2 (both are plain uint32_t register accumulations, if_bwn_util.h / if_bwn_phy_lp.c:3529-3537): guard passes (sum = 2).

CALC_COEFF(tmp[0], _x=bwn_nbits(ie_iqprod), _y=ie_iqprod, _z=ie_ipwr=0) — lines 2308-2316: _t = _x - 20; - _t >= 0: _v = ((_y << (30 - _x)) + (_z >> (1 + _t))) / (_z >> _t); → (_z >> _t) = 0 → idivl by zero → x86 #DE → DragonFly kernel panic. - _t < 0: ... / (_z << -_t) → 0 << k = 0 → same. CALC_COEFF2 (2317-2324) divides by (_z >> _t) / (_z << -_t) identically.

No other check on ie_ipwr exists anywhere between the register read (3532-3534) and the macros.

Reachability reasoning (why 'likely', not 'speculative')

• bwn_phy_lp_rx_iq_est returns 1 (estimator ran, 3518-3527) with all-zero or asymmetric accumulators whenever the PHY's IQ estimator block is misconfigured or the I-path is physically dead — the estimator counter register just accumulates 0.
• The call is made while the RX front-end is forced into an artificial override state (trsw_over TX=1 RX=0 at 735, forced RF_OVERRIDE_0 0x800 at 748-749) — precisely the regime where a marginal radio reads pathological values.
• It runs at every bwn_phy_lp_init (line 482) and every 60 seconds (bwn_phy_lp_task_60s → bwn_phy_lp_calib → line 752; the driver even marks the ignored return value /* XXX no checking return value? */ at 751) — so one occurrence bricks the system repeatedly.
• Not software-reachable: no user input reaches ie_ipwr; requires the radio to actually report 0 I-power. Fault-injection on the PCIe device (a compromised b43 firmware/dongle attack) would make it deterministic.

Guest

No Broadcom wireless hardware (env.txt) — bwn never attaches; path untestable there.

Fix

fix.diff extends the guard with || ie.ie_ipwr == 0 (git apply --check passes). Upstream FreeBSD has the identical defect and needs the same guard.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.