# DF-1769 — verification verdict

| Field | Value |
|-------|-------|
| **Verdict**     | SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest) |
| **Impact**      | heap OOB read |
| **Confidence**  | certain (source-trace) |
| **Guest**       | DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 |
| **Module/kernel** | not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel |
| **Citations**   | sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c:607 |

## Mechanism

ar9285SetPowerCalTable line 607: for(i=0;i<AR5416_MAX_CHAINS=3; i++) but v4k EEPROM has calPierData2G[AR5416_4K_MAX_CHAINS=1][3]. When txMask & (1<<1) or (1<<2), accessing pEepData->calPierData2G[1] or [2] is an OOB read into adjacent struct fields.

**Root cause:** Generic chain count 3 used for 4K EEPROM with only 1 chain slot.

## Reproduction note (HW/module-gated)

DF-1769 lives in `sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c` which is either (a) not compiled into the
default `X86_64_GENERIC` kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt
driver only — loaded via kldload) or (b) gated by absent hardware on this
audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID
controller, no CardBus bridge). The bug is **source-confirmed** by tracing
the cited path line-by-line; a live trigger would require the corresponding
hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build
validated in this run.

## Fix

Add '&& i < AR5416_4K_MAX_CHAINS' to the txMask condition. Matches finding proposal.


## Phase 8 — combined fix-kernel build validation

`fix.diff` was one of 35 standalone `git apply`-able patches batched into a single
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest.

**Result:** combined kernel build **rc=0** with `-Werror` clean (no warnings).

- Build log: `combined_build.log` (35666 lines, full untrimmed `make` output).
- Single-fix kernel artifact:
  `/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped`
  sha256 `eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7`,
  built `Wed Jul 22 15:42:55 UTC 2026`.
- All 35 patches applied cleanly via `patch -p1 --forward` (no rejects).

Because DF-1769 is HW/module-gated (not compiled into the default GENERIC kernel
or requires hardware absent on the audit guest), the combined kernel was not
booted for a runtime re-test; the source-level correctness of the fix is
validated by the rc=0 -Werror build, which is the appropriate validation for
HW-gated findings.