# VERDICT — DF-3836

**status: inconclusive (source-certain, hardware-gated)** — reproduced: 0 — guest impact: none.

## Defect demonstration (source-level)
`bwn_phy_lp_b2063_switch_channel` — if_bwn_phy_lp.c:792-808:

  line 794: `static const struct bwn_b206x_chan *bc = NULL;`  ← persistent storage
  lines 801-806: linear search; `bc` assigned only on match
  lines 807-808: `if (bc == NULL) return (EINVAL);`           ← only detects first-call miss

Call sequence: switch(36) succeeds → bc = &bwn_b2063_chantable[17] forever. Any later
switch(chan ∉ table): loop ends unassigned, bc != NULL, RF is programmed with channel 36's
`bc_data[]` (lines 810-921), function returns 0. Caller (bwn_phy_lp_switch_channel:567-581)
stores `plp->plp_chan = chan` and writes BWN_CHANNEL — divergent state.

Control: the b2062 sibling at line 926 uses `const struct bwn_b206x_chan *bc = NULL;`
(no `static`) — the intended pattern; its `bc == NULL` check is sound.

## Practical reachability
Callers pass `ieee80211_chan2ieee(ic, ic->ic_curchan)` (if_bwn.c:1911→4434) or the literal 7
(if_bwn_phy_lp.c:477, 1763). All net80211-regdomain channels currently exposed are present in
the 58-entry table, so the stale path needs a future channel-set expansion or a half/quarter
channel — hence Low. No memory-safety consequence (bc points into valid const data); impact is
wrong-frequency operation.

## Guest
No Broadcom wireless PCI device (env.txt); bwn never attaches; not exercisable.

## Fix
Delete `static` (fix.diff, matches the b2062 form and FreeBSD's own b2062 function).
`git apply --check` passes. Upstream FreeBSD carries the same `static` in its b2063 function
(their line 815) and should receive the same fix.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.