# DF-1308 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier channel is BCHAN_UNUSED

## Source Location
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2108-2201

## Verdict
Source-confirmed (complex fix): OOB read in ar5416GetTargetPowers/GetTargetPowersLeg when first pier c. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
ar5416GetTargetPowers at ar5416_reset.c:2108 and GetTargetPowersLeg at :2168: if freq>fbin2freq(0xFF)=255 (all WiFi channels), enter else branch. Loop i=0 if powInfo[0].bChannel==0xFF sentinel. Post-loop: matchIndex=i-1=-1. Else branch reads powInfo[lowIndex=-1] repeatedly. HALASSERT compiled out by default (AH_ASSERT opt-in). Intra-struct OOB read into preceding EEPROM field. Attacker: malicious/buggy NIC EEPROM. Fix: check i==0 -> matchIndex=0.