# DF-1447 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
OOB read of static wordsForPdgains[] when EEPROM xpd_mask has no set bits (numPdGains=0)

## Source Location
sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:763-782

## Verdict
Source-confirmed: OOB read of static wordsForPdgains[] when EEPROM xpd_mask has no set b. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
readEepromRawPowerCalInfo2413 at ah_eeprom_v3.c:763-764/781-782: wordsForPdgains[numPdGains-1]. wordsForPdgains[4]={4,6,9,12}. numPdGains from 4-bit EEPROM ee_xgain, can be 0. numPdGains-1=-1 -> wordsForPdgains[-1] OOB read of adjacent .rodata. Garbage feeds EEPROM offset calc. Crafted EEPROM on AR2413. No write/userspace leak. Fix: check numPdGains>=1 before indexing.