# DF-2073 PoC — ResetKeyCacheEntry MIC-clear lacks runtime bounds check

## Status

Speculative — not directly reachable from unprivileged userspace. Requires
privileged HAL capability manipulation (disable MIC, install high-index TKIP
key, re-enable MIC, then reset key).

## Preconditions

1. AR5212-class ath(4) NIC present
2. GENERIC kernel (no AH_ASSERT — HALASSERT is inert)
3. Privileged access to HAL capability control (disable/re-enable MIC)

## Trigger sequence

1. Disable MIC capability (clear AR_STA_ID1_CRPT_MIC_ENABLE)
2. Install TKIP key at high index E where E < halKeyCacheSize but E+64 >= size
   (SetKeyCacheEntry:185 check is skipped when MIC disabled)
3. Re-enable MIC
4. Delete/reset the key → ar5212ResetKeyCacheEntry executes OS_REG_WRITE
   to AR_KEYTABLE_KEY0(E+64) with E+64 >= size → MMIO write past keycache
   aperture

## Expected output

Best case: write ignored/unmapped (no visible effect).
Worst case: kernel panic from PCI bus fault or adjacent register corruption.

## Fix

Replace HALASSERT with runtime `if (micentry >= halKeyCacheSize) return AH_FALSE`,
mirroring ar5212SetKeyCacheEntry:185.