DF-4765 — divide-by-zero panic in hpt_copy_array_info rebuild/verify percentage (bArnMember==1 / tiny per-member capacity)

File: sys/dev/raid/hptmv/hptproc.c (pass 2)

Build & run (same KLD harness as DF-4764)

./build.sh          # builds /root/h1/h1harness.ko on the guest
kldload /root/h1/h1harness.ko
sysctl h1harness.trigger=2     # baseline: panics (Fatal trap 18)
# after reset + rebuild: sysctl h1harness.trigger=5  -> fix: survives

Expected baseline (run.log)

=== H2 (DF-4765) bArnMember==1 -> div/0 ===
H2: real RAID-1 array, bArnMember=1 rf_verifying=1
Fatal trap 18: integer divide fault while in kernel mode
Stopped at hpt_copy_array_info.constprop.3+0x187:  divq %rdi,%eax

Why it is reachable

• gui_lib.c:614 accepts AT_RAID1 with nDisk <= 2 — a 1-member mirror (bArnMember = pParam->nDisk = 1 at :618) is the create-and-duplicate starting state.
• hptproc.c:182-183 lets the verify start N sysctl command run on any RAID-1/RAID-5 array regardless of member count.
• The percentage ksprintf at hptproc.c:457/462 divides by (VDeviceCapacity/(bArnMember-1))>>11 with no guard.
• The outer divisor is also 0 whenever per-member capacity < 2 MB.

Detonator: any local user reading sysctl hptmv.status (world-readable). Precondition: hptmv hardware with such an array (absent from audit guest; verified via verbatim-code harness — see VERDICT.md in DF-4764).

Fix: fix.diff F2 hunk (guarded divisor) — validated in-harness (trigger 5 survives, prints Verifying 0%).

DF-4765 VERDICT

Status: REPRODUCED (source+harness). See ../DF-4764/VERDICT.md for the shared harness methodology; this trigger uses a REAL RaidArray (no type confusion) with bArnMember==1, rf_verifying==1:

• run.log: Fatal trap 18: integer divide fault while in kernel mode, Stopped at hpt_copy_array_info.constprop.3+0x187: divq %rdi,%rax.
• run.fixed.log (trigger 5, fix.diff F2): prints 1 RAID 1 ... Verifying 0% and survives.

Reachability chain (static): HPT_IOCTL_CREATE_ARRAY AT_RAID1 nDisk=1 → gui_lib.c:614 (nDisk <= 2) + :618 (bArnMember = pParam->nDisk) → 1-member mirror; verify start accepted at hptproc.c:182-183 (type check only) → rf_verifying set by the rebuild DPC → any unprivileged sysctl hptmv.status read → hptproc.c:462 x / 0 → SIGFPE panic.

The 1-member flag state is set by the closed-source raid library (x86_64-elf.raid.o.uu) — flagged as the one unverifiable link; confidence 'likely'. The alternative trigger (per-member capacity < 2 MB ⇒ zero denominator with bArnMember==2) needs no flag logic beyond capacity.

Kernel refs: hptproc.c:457, hptproc.c:462, gui_lib.c:614, gui_lib.c:618, hptproc.c:182.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.