# DF-1309 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Static buffer overflow in ath_ee_FillVpdTable via crafted EEPROM pdg power range >126

## Source Location
sys/dev/netif/ath/ath_hal/ar5416/ar5416_reset.c:2427-2484

## Verdict
Source-confirmed (complex fix): Static buffer overflow in ath_ee_FillVpdTable via crafted EEPROM pdg p. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
ar5416GetGainBoundariesAndPdadcs at ar5416_reset.c:2427-2433: vpdTableL/R/I[AR5416_NUM_PD_GAINS][AR5416_MAX_PWR_RANGE_IN_HALF_DB=64]. ath_ee_FillVpdTable loop for(i=0;i<=(pwrMax-pwrMin)/2;i++) at ah.c:1322. pwrMax-pwrMin from EEPROM pwrPdg[4]-pwrPdg[0] (u8). Range up to 255 -> (255)/2=127 writes into 64-byte buffer. HALASSERT compiled out. EEPROM XOR checksum forgeable. Attacker: malicious NIC EEPROM. Fix: clamp loop i<AR5416_MAX_PWR_RANGE_IN_HALF_DB.