{
  "finding_id": "DF-3615",
  "title": "Unvalidated hardware-fed ts_antenna indexes ast_ant_tx[8]/sc_ant_tx[8] in ath_tx_update_stats (latent OOB write; RX twin clamps after field crashes)",
  "verdict_summary": "Source-certain missing bounds check on the TX-completion path. Not executable on this guest (no Atheros NIC; TX-completion interrupt path needs hardware) and latent with in-tree HALs (ar5210/5211/5416/9300 emit 0, ar5212 emits 1..2). Geometry measured on guest: indices 183-246 from ast_ant_tx hit sc_rx/sc_tx function-pointer tables; index 8 from sc_ant_tx hits the sc_cabq pointer; indices >140 pass the end of the 13392-byte softc heap allocation.",
  "reproduce": {
    "build": "sh build.sh   (KLD offset-printer against X86_64_GENERIC obj tree)",
    "run": "kldload ./off.ko; dmesg | grep OFF; kldunload off",
    "expected": "OFF lines showing ath_softc offsets (see offsets_dmesg.txt / run.log)"
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath/if_ath.c:4196",
    "sys/dev/netif/ath/ath/if_ath.c:4197",
    "sys/dev/netif/ath/ath/if_ath.c:4198",
    "sys/dev/netif/ath/ath/if_ath.c:4199",
    "sys/dev/netif/ath/ath/if_athioctl.h:117",
    "sys/dev/netif/ath/ath/if_athvar.h:815",
    "sys/dev/netif/ath/ath_hal/ah_desc.h:56",
    "sys/dev/netif/ath/ath/if_ath_rx.c:828",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:943",
    "sys/contrib/dev/ath/ath_hal/ar9300/ar9300_xmit_ds.c:354"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "offmod.c", "Makefile", "build.sh",
    "build.log", "run.log", "offsets_dmesg.txt", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}