{
 "finding_id": "DF-2355",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "mt7601_set_chan (if_mtw.c:3692-3734) verbatim rig: chan=15 walks mt7601_rf_chan[14] off the end - the verbatim function on the real table SIGSEGVs (0x403000) in the userspace twin, the relocated-table variant SIGSEGVs at the guard page, and the crafted-15th-row variant shows the other outcome: the walk stops at i=14 and programs the RF registers plus TX power with garbage. chan=6 hits the correct row. With the nitems-bounded loop the verbatim function returns cleanly past the table (unsupported-channel print) and the control is unchanged. Reachability is the defense-in-depth failure the finding states: radiocaps only advertises channels 1-14, so this needs a driver-level caller bug to reach.",
 "exploit_chain": "",
 "evidence": "run.log (guard SIGSEGV 0x800474000; walk-real SIGSEGV 0x403000; sentinel i=14 garbage row; control row 6), run_fixed.log (walk-real child_exit=0), fix.diff",
 "kernel_refs": [
  "sys/bus/u4b/wlan/if_mtw.c:3699",
  "sys/bus/u4b/wlan/if_mtw.c:3702",
  "sys/bus/u4b/wlan/if_mtw.c:3708"
 ],
 "poc_changes": "guard/sentinel scenarios use a relocated copy with the verbatim loop shape (deterministic placement); the walk-real scenario calls the untouched verbatim function on the real static table",
 "attempts": 4,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #5 DFBATCH Wed Oct 21 21:27:34 UTC 2026 root:/usr/obj/usr/src/sys/DFBATCH x86_64 (rig kernel); stock baseline #0 X86_64_GENERIC",
 "runtime_sec": 240,
 "guest_dirty": 0,
 "build_cmd": "sh build.sh (userspace verbatim rig)",
 "run_cmd": "./run.sh  (guard sentinel walk-real control)",
 "code_hash": "c18f39cf3efba2d4764f9a69ed1497413f52e85ea8f0852fb0fe4e982cb19676",
 "notes": "fix validated A/B on the same rig: baseline behavior gone post-patch (see run_fixed* logs); rig kernel = X86_64_GENERIC + device dfbatch, INVARIANTS kept",
 "recommended_fix": "bound the channel search with nitems() and refuse unsupported channels"
}