# DF-1247 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
Out-of-bounds read in bwn_phy_g_dc_lookup_init via hardcoded loop bound (64 vs 63 valid pairs)

## Source Location
sys/dev/netif/bwn/bwn/if_bwn_phy_g.c:2599-2617

## Verdict
Source-confirmed: Out-of-bounds read in bwn_phy_g_dc_lookup_init via hardcoded loop boun. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
bwn_phy_g_dc_lookup_init at if_bwn_phy_g.c:2608: loop for(i=0;i<BWN_DC_LT_SIZE*2;i++) hardcoded 64. When hwpctl (PHY rev>=6): rfatt=7 entries, bbatt=9 entries, 63 valid pairs. KASSERT 7*9=63<=64 passes. At i=63: bb_offset=63/7=9, indexes bbatt_0[9] one past 9-element array. Triggered on every driver init of BCM43xx G-PHY rev>=6. OOB read from .rodata, value used as RF calibration bbatt, written to PHY MMIO. No userspace disclosure. Fix: loop bound = rfatt.len*bbatt.len instead of BWN_DC_LT_SIZE*