# PoC DF-1521: ath_hal_getdiagstate NULL deref (NULL outdata/indata)

**Class:** NULL pointer write/read
**Cited site:** `sys/dev/netif/ath/ath_hal/ah.c:890-907`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/netif/ath/ath_hal/ah.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

HAL_DIAG_REGS calls ath_hal_getregdump(ah, args, *result,*resultsize); if user omits ATH_DIAG_DYN, ath_ioctl_diag never kmallocs outdata -> *result==NULL -> first *dp++ writes to NULL. If user omits ATH_DIAG_IN, indata is NULL -> args==NULL -> regs[0].start reads addr 0. HAL_DIAG_EEREAD at 901-907 same pattern.

## Realistic impact ceiling (on suitable HW)

NULL-deref kernel panic; potential arbitrary write to addr 0 on no-MMU/low-mem

## Fix

Top-of-function NULL guard on (*result, *resultsize) plus per-case NULL guards for args in HAL_DIAG_REGS and HAL_DIAG_EEREAD.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1521.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1521.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```