{
  "finding_id": "DF-3753",
  "title": "rt2860: unvalidated legacy-rate lookup -> rt2860_rates[255] OOB read (tx) and 1<<255 UB (set_basicrates, peer-fed rateset)",
  "verdict": "not_reproduced (guest lacks Ralink hardware; Info hardening, source-certain)",
  "impact_class": "const-table OOB read + UB shift, MMIO/air-interface impact only",
  "reproduce": {
    "precondition": "ral(4); site 1 needs invalid fixed rate (misconfig), site 2 needs peer beacon/assoc rate IE with out-of-mode basic rate",
    "steps": ["trigger rt2860_tx / rt2860_set_basicrates with unknown rate code"],
    "expected": "garbage MCS/duration or wrong BASIC_RATE register; no crash"
  },
  "kernel_refs": ["sys/dev/netif/ral/rt2860.c:1576", "sys/dev/netif/ral/rt2860.c:2362", "sys/dev/netif/ral/rt2860.c:1834"],
  "artifacts": ["README.md", "fix.diff", "verdict.json", "env.txt", "manifest.json"]
}