# DF-3615 — VERDICT

**Status: inconclusive** (defect source-certain; not executable on this guest)

## Reproduced?
The *corrupting write* was NOT reproduced — it cannot be: the guest has no
Atheros hardware (env.txt: `pciconf -l` has no ath device, `dev.ath` sysctl
count 0), and the write sits on the hardware TX-completion path
(ath_intr -> sc_txtask -> ath_tx_processq -> ath_tx_process_buf_completion
-> ath_tx_update_stats, sys/dev/netif/ath/ath/if_ath.c:4188-4199).
Additionally, with the HALs currently in-tree the index never exceeds 2
(ar5210/ar5211/ar5416/ar9300 write constant 0; ar5212 writes 1..2), so even
with a NIC the OOB does not fire today — it is a latent driver-side
hardening gap against the exact failure mode that already crashed users on
the RX side (if_ath_rx.c:809-835 comment: AR9285 "rs_antenna field is
bogusly large" -> crashes; upstream added the RX clamp).

## What WAS verified on the guest
The corruption geometry was measured, not guessed: a KLD (offmod.c) built
inside the guest's kernel build environment (make -DNO_WERROR against
/usr/obj/usr/src/sys/X86_64_GENERIC, logs in build.log/run.log) printed the
real ath_softc layout — offsets_dmesg.txt:

- sizeof(ath_softc)=13392; sc_stats.ast_ant_tx=7820; sc_ant_tx=12832
- index 183..246 from ast_ant_tx hits the sc_rx/sc_tx function-pointer
  method tables (8552/8736)
- index 8 from sc_ant_tx hits the sc_cabq pointer exactly (12864)
- index >140 from sc_ant_tx passes the end of the softc heap allocation
  (13852 > 13392) — adjacent-heap increment primitive

Module presence was also verified: if_ath.ko / ath_hal.ko / ath_rate.ko /
ath_dfs.ko ship in /boot/kernel (compiled for the stock kernel) — the code
is live attack surface on any machine with an Atheros NIC, not dead code.

## Exploit chain (if ever triggerable)
hardware/HAL emits antenna=N>7 -> `sc->sc_stats.ast_ant_tx[N]++` /
`sc->sc_ant_tx[N]++` on every successful TX completion -> repeated +1 on a
chosen dword in/past ath_softc (function-pointer table entries, sc_cabq,
sc_bslot[], or past-object heap) -> misdirected indirect call / corrupted
queue pointer -> kernel code execution or panic. Requires a HAL (or
misbehaving NIC firmware) that forwards an unbounded antenna byte — the
documented AR9285-class erratum precedent exists on the RX side.

## Root cause
sys/dev/netif/ath/ath/if_ath.c:4197-4199 — hardware-fed uint8_t used as
array index into two [8] arrays with no clamp, unlike the RX path at
sys/dev/netif/ath/ath/if_ath_rx.c:828-835 which clamps for exactly this
documented reason.

## Fix
Driver-side clamp mirroring the RX path (fix.diff). Validated as a compile
sanity check only (no hardware to run): see fix_status=not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.