--- a/sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c	2026-10-21 04:27:46.555052069 +0000
+++ b/sys/contrib/dev/ath/ath_hal/ar9300/ar9300_paprd.c	2026-10-21 04:27:46.563051967 +0000
@@ -1,3 +1,26 @@
+    /* DF-2259: bins whose accum_cnt falls below thresh_accum_cnt never
+     * write x_est/y/theta below, but later code sums theta[1..5] and
+     * compares x_est[6]-x_est[3] unconditionally.  Zero every estimator
+     * array up front so sparse training data cannot propagate
+     * uninitialized (and potentially signed-overflowing) stack values
+     * into the predistortion tables. */
+    OS_MEMZERO(x_est, sizeof(x_est));
+    OS_MEMZERO(y, sizeof(y));
+    OS_MEMZERO(theta, sizeof(theta));
+    OS_MEMZERO(y_sqr, sizeof(y_sqr));
+    OS_MEMZERO(y_quad, sizeof(y_quad));
+    OS_MEMZERO(theta_tilde, sizeof(theta_tilde));
+    OS_MEMZERO(pa_angle, sizeof(pa_angle));
+    OS_MEMZERO(b1_tmp, sizeof(b1_tmp));
+    OS_MEMZERO(b2_tmp, sizeof(b2_tmp));
+    OS_MEMZERO(b1_abs, sizeof(b1_abs));
+    OS_MEMZERO(b2_abs, sizeof(b2_abs));
+    OS_MEMZERO(y_lin, sizeof(y_lin));
+    OS_MEMZERO(y_est, sizeof(y_est));
+    OS_MEMZERO(x_est_fxp1_nonlin, sizeof(x_est_fxp1_nonlin));
+    OS_MEMZERO(x_tilde, sizeof(x_tilde));
+    OS_MEMZERO(x_tilde_abs, sizeof(x_tilde_abs));
+
     int g_fxp;
     int y_intercept;
     int order_x_by_y;