If H(m) = 0 for some m, how can a DSA signature be forged? If we know for some message $m$ that $H(m) = 0$, how can we forge a DSA signature with only the public key?

I got that $g^s*r = (g^x)^r$ where $x$ is the private key, but that's one equation with 2 unknowns, and since discrete log is hard, I can't substitute a value for either $s$ or $r$ and find the other and satisfying the condition $0 &lt; s$ and $r &lt; q$ at the same time.
The signature equation is $$r = (g^{H(m) s^{-1}} y^{r s^{-1}} \bmod p) \bmod q,$$ where $g$ is the standard generator of an order-$q$ subgroup of $\mathbb Z/p\mathbb Z$, $y \in \mathbb Z/p\mathbb Z$ is a public key, $m$ is a message, and the signature is $(r, s)$ for scalars $r, s \in \mathbb Z/n\mathbb Z$.

If $H(m) = 0$, this reduces to $r = (y^{r s^{-1}} \bmod p) \bmod q$.  If you pick $r = s = y \bmod q$, then $r s^{-1} \equiv 1 \pmod q$, so $y^{r s^{-1}} \bmod p = y$ and so $(y^{r s^{-1}} \bmod p) \bmod q = y \bmod q = r$ as desired.