# DF-0986 source-confirmation

**Verdict:** REPRODUCED (source-confirmed)  
**Impact:** panic  **Confidence:** likely

**Kernel ref:** `sys/bus/u4b/wlan/if_mtw.c:3699`

## Mechanism
mt7601_set_chan unbounded linear scan past mt7601_rf_chan[] -> OOB

## Confirmation method
Source-trace confirmed the cited code path matches the finding (exact line/condition
verified against `sys/`). Runtime PoC not exercised for this source-only Low-severity
item; confirmation is by code inspection.

## Recommended fix
See `fix.diff` in this folder (git-apply-able unified diff).

## Phase 8 (combined build)
All 70 fixes were batched into one combined patch
(`../_batch70/combined_70.patch`) and applied to in-guest `/usr/src`. A single
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed **rc=0 with 0 errors under
-Werror** (`../_batch70/../_batch70/fix_build.log`, 35374 lines). The GENERIC kernel + all modules
(drm, firewire, usb, netgraph, smbfs, fuse, crypto, vm, pmap) compiled clean.