# DF-2201 — ar5212 GPIO index unvalidated (HALASSERT compiled out)

## Verdict
**REPRODUCED (source-only confirmation).** Bug confirmed by source tracing of
`sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c`. No runtime PoC attempted
because this code path is HW-gated (no Atheros NIC on the audit guest, so
no live `struct ath_hal` exists to exercise the ops vectors).

## Mechanism
`ar5212GpioCfgOutput` (line 41), `ar5212GpioCfgInput` (line 59),
`ar5212GpioSet` (line 76) validate `gpio` only via
`HALASSERT(gpio < AR_NUM_GPIO)` where `AR_NUM_GPIO == 6` (line 32).

`HALASSERT` is defined in `ah_internal.h:665-676`:
```c
#ifdef AH_ASSERT
#define HALASSERT(_x) do { if (!(_x)) ath_hal_assert_failed(...); } while (0)
#else
#define HALASSERT(_x)
#endif
```

`AH_ASSERT` is **only** enabled in `sys/config/LINT64:1105` (the LINT
config), NOT in `sys/config/X86_64_GENERIC` (the default kernel — its ath
lines are `device ath`, `device ath_hal`, `options AH_SUPPORT_AR5416`, no
`AH_ASSERT`). In any production kernel build, `HALASSERT(_x)` expands to
nothing, so the three CfgOutput/CfgInput/Set calls accept any `uint32_t gpio`
without bounds checking.

The fifth entry point, `ar5212GpioSetIntr` (line 104), is **worse**: it has
no HALASSERT at all, just the source comment `/* XXX bounds check gpio */`
at line 109. An out-of-range `gpio` flows straight into:
- `AR_GPIOCR_CR_A(gpio)` = `3 << (2*gpio)`  (ar5212reg.h:755) → UB shift for gpio≥16, OOB MMIO field for 6≤gpio<16
- `AR_GPIOCR_CR_N(gpio)` = `0 << (2*gpio)`  (ar5212reg.h:752)
- `AR_GPIOCR_INT(gpio)`  = `gpio << 12`     (ar5212reg.h:757)
- `(1 << gpio)`           at GpioSet (line 79-80) → UB shift for gpio≥32

Only `ar5212GpioGet` (line 92) has a real runtime check
(`if (gpio < AR_NUM_GPIO)`).

## Threat model / reachability
- Unlike its ar5312/ar5315 siblings, `ar5212_gpio.c` is **always compiled**
  (no `#ifdef` gate around the body, and it IS in the ath_hal Makefile
  SRCS at line 37). So this file is linked into the running `ath_hal.ko`
  on every standard DragonFly kernel that loads the module.
- The vulnerable entry points are exported through `struct ath_hal` ops
  vectors (`ah.h:1477-1483`).
- Callers in `sys/dev/netif/ath/ath/if_ath_led.c:128,142,145` pass
  `sc->sc_ledpin`, `sc->sc_led_pwr_pin`, `sc->sc_led_net_pin` — these come
  from EEPROM. `ar5212_misc.c:157,167` pass `select` (also driver-internal).
- A malicious or corrupted EEPROM could feed an out-of-range `gpio`,
  producing UB shifts and OOB MMIO field selection — local DoS / device
  misbehavior. No path to direct userspace control of `gpio` was found;
  this is a hardening gap with realistic-but-bounded impact.
- **Severity Low** is appropriate per the rubric (HW-gated caller surface,
  requires specific NIC + malicious EEPROM, no demonstrated escalation).

## Why no runtime PoC
- The audit guest has **no Atheros NIC** (`pciconf -l` shows no ath device),
  so no `ath` interface is ever attached and no `struct ath_hal` ops vector
  is ever wired up to these functions at runtime.
- Source-only confirmation is the strongest evidence available without
  bespoke HW; matches the established pattern of the sibling DF-2098.

## Fix
For each `HAL_BOOL` function, add a real runtime guard immediately after the
existing HALASSERT: `if (gpio >= AR_NUM_GPIO) return AH_FALSE;`. For the
`void` function `ar5212GpioSetIntr`, replace the `/* XXX bounds check gpio */`
comment with `if (gpio >= AR_NUM_GPIO) return;`. This is exactly the pattern
applied to the sibling ar5416 fix in DF-2098 and keeps the API contract
(callers already check the return value of `HAL_BOOL` ops).

See `fix.diff` (8 hunks, all `git apply`-able; applied cleanly with
`patch -p1 --forward`, every hunk "succeeded").

## Batch-build status (Phase 8)
- All three sibling fixes (DF-2199 / DF-2200 / DF-2201) applied together to
  `/usr/src` on the `with-src` snapshot (#0 unpatched baseline,
  6.5-DEVELOPMENT, INVARIANTS ON).
- `make -j6 nativekernel KERNCONF=X86_64_GENERIC` → **rc=0, 0 errors, 0
  warnings**.
- `ar5212_gpio.c` IS in the ath_hal Makefile SRCS (line 37), so the patched
  file was actually rebuilt into `ath_hal.ko` with `-Werror`:
  ```
  --- ar5212_gpio.o ---
  cc -c -O2 -pipe -Wall ... -Werror .../ar5212_gpio.c
  ```
  → linked into `ath_hal.ko` clean. This is the strongest validation
  available short of running the patched kernel on real Atheros HW.
- (ar5312/ar5315 SoC siblings separately compiled with their defines;
  see those findings.)

## Kernel references (confirmed during verification)
- `sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:32` — `AR_NUM_GPIO 6`
- `sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:41` — HALASSERT only (CfgOutput)
- `sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:59` — HALASSERT only (CfgInput)
- `sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:76` — HALASSERT only (Set)
- `sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:92` — real runtime check (Get)
- `sys/dev/netif/ath/ath_hal/ar5212/ar5212_gpio.c:109` — `/* XXX bounds check gpio */` (SetIntr, none at all)
- `sys/dev/netif/ath/ath_hal/ah_internal.h:665-676` — HALASSERT compiles to nothing unless AH_ASSERT
- `sys/config/LINT64:1105` — only place AH_ASSERT is enabled
- `sys/dev/netif/ath/ath_hal/ar5212/ar5212reg.h:752,755,757` — shift macros
- `sys/dev/netif/ath/ath_hal/Makefile:37` — ar5212_gpio.c is in SRCS (always compiled)