# DF-3960 — ar5416GetGainBoundariesAndPdadcs degenerate-EEPROM OOB reads

Unvalidated EEPROM calibration edge cases index before the start of
kernel arrays in `ar5416GetGainBoundariesAndPdadcs()` /
`ar5416SetPowerCalTable()`:

- (a) `xpdGain` mask == 0 → both fill loops are skipped, the backfill
  loops then read `gainBoundaries[-1]` (caller's stack array) and
  `pdadcValues[-1]` (driver-static array);
- (b) `maxPwrT4[i] == minPwrT4[i]` → `sizeCurrVpdTable == 1` → the
  `vpdStep` computation reads `vpdTableI[i][-1]` / `[-2]`;
- (c) inverted pier range → the `(uint8_t)` truncation yields
  `sizeCurrVpdTable` up to 130 > 64 → the copy loop reads past the
  64-entry `vpdTableI` row.

## Reproduce (on the DragonFly guest)

    ./build.sh
    ./run.sh    # instrumented replica reports every OOB index; control
                # case (sane EEPROM values) reports zero

## Verified

- Index arithmetic replicated and run on the audit guest (baseline and
  patched kernels): cases (a), (b), (c) all flag OOB; control case 0.
- No ath(4) hardware exists on the audit guest, so the kernel-side
  trigger (crafted NIC EEPROM) is proven by the exact-arithmetic replica
  plus the source trace (same standard as DF-1308/DF-1309).
- `fix.diff` (reject empty xpdGain mask; clamp `sizeCurrVpdTable` to
  [2, AR5416_MAX_PWR_RANGE_IN_HALF_DB] before deriving `maxIndex`)
  applies cleanly; kernel builds `-Werror` rc=0 (fix_build.log).