# DF-2060 — PoC evidence pack

**Finding:** Invalid free / non-heap kfree in ath_ioctl_diag (ATH_DIAG_DYN + HAL_DIAG_REVS/FATALERR)
**Class:** Free of memory not at start of buffer / invalid free (CWE-590)  |  **Impact ceiling:** panic  |  **Confidence:** certain

## Status

SOURCE-CONFIRMED. The defect is verified real by line-by-line tracing of the
audited `sys/` tree, but it is **HW/module-gated**: the audit guest lacks the
required hardware/module (Atheros (ath) WLAN NIC present; ATH_DIAGAPI compiled in; reachability ungated only because of DF-2059), so it cannot be triggered at runtime
here. See `VERDICT.md` for the full mechanism and citations.

## How to reproduce (on a guest that HAS the hardware)

1. Ensure the gating precondition is met: Atheros (ath) WLAN NIC present; ATH_DIAGAPI compiled in; reachability ungated only because of DF-2059.
2. Apply `fix.diff` to confirm the cited path changes; before the fix the cited
   code path exhibits the behaviour described in `VERDICT.md`.
3. The original finding markdown describes the runtime trigger.

## Build validation (Phase 8)

`fix.diff` applies cleanly to pristine source. All nine findings' fixes were
built together; see `VERDICT.md` "Phase 8" and `fix_build.log`:

    make -j6 nativekernel KERNCONF=X86_64_GENERIC   # rc=0, -Werror, 0 warnings

## Files

- `VERDICT.md` — full narrative, mechanism, citations, fix-build result
- `fix.diff` — standalone `git apply`-able fix (authored post-verification)
- `fix_build.log` — full combined-fix kernel build output (rc=0, -Werror)
- `env.txt` — guest environment for this verification
- `manifest.json` — machine-readable catalog