InferShape4STFT reads the required n_fft attribute at lines 67-69 and derives hop_length as n_fft >> 2 at line 72 without checking that either value is positive. For n_fft in 0..3 with hop_length omitted or set to 0, hop_length remains 0, so line 94 evaluates (len - n_fft) / hop_length and performs integer division by zero in the host infershape path registered at line 166. The same unchecked path accepts n_fft <= 0 and len < n_fft and writes invalid non-positive output dimensions. The OpDef declares n_fft as an Int attribute without a range constraint, so this is reachable from normal graph construction.