# DF-2221 — PoC verdict

**File:** `sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

ar5312EepromRead() indexes eepromAddr[2*off] from a caller-supplied u_int off with NO bounds check, NO NULL check on the BSP-supplied radio-config pointer, and unconditionally returns AH_TRUE. The sibling ar5212EepromRead is hardware-guarded; this AR5312 variant is not. Reachable via SIOCGATHDIAG/HAL_DIAG_EEREAD with no privilege check on the path.

### Cited lines

- `sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c:34-46`

## Why it does not reproduce on this guest

No Atheros AR5312 wifi adapter on the QEMU guest; the AR5312 HAL is not compiled into the running kernel (nm /boot/kernel/kernel: ar5312EepromRead = 0 symbols). usbconfig/ifconfig show no ath interface.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Add a NULL check on eepromAddr and bound off against AR5312_EEPROM_MAX (1024 words) added near the function; return AH_FALSE out of range.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)