# VERDICT — DF-3977

**status: inconclusive** (hardware-gated; source-level certainty: certain for the ep[-1] read shape,
likely for end-to-end reachability which additionally requires the zeroed-EEPROM condition)

## Analysis performed

Read ar5212_reset.c end-to-end (2802 lines) plus the data-feeding layers: ah_eeprom_v3.c/h (target
powers, CTL edges, spur channels, gain deltas), ah_eeprom_v14/v4k/9287 ctl backends, ar5212.h
(ah_pcdacTable/ah_ratesArray), ar5212_attach.c (M_ZERO allocation), ah_osdep.c (ath_hal_malloc =
kmalloc M_ZERO).

Every checklist item was driven to a conclusion (see README "Verified NOT vulnerable"). The single
surviving memory-safety defect is `ar5212GetLowerUpperValues` (ar5212_reset.c:2639/2643) reading
`lp[0]` (uninitialized stack — the caller's fill loop never ran) and `ep[-1]` (2 bytes below the
caller's `tempChannelList[]`) when `listSize == 0`. Reachable from:

1. `ar5212GetTargetPowers` with `ee_numTargetPwr_11b/11g == 0` (all testChannels zero in the EEPROM
   group — ah_eeprom_v3.c:973-999 counts only non-zero entries; ar5212_reset.c:2303/2218 pass the
   count unguarded), and
2. `ar5212GetMaxEdgePower` with `numEdges == 0` (a CTL whose index byte is non-zero but whose edge
   block is all zeros — ar5212_reset.c:2500-2505).

Consequences: uninitialized stack values select the lower/upper "pier" channels; the subsequent
index walk in GetMaxEdgePower silently uses entry 0 of the empty CTL (HALASSERT is a no-op in
release), which can program `MAX_RATE_POWER` for the channel — a regulatory TX-power bypass — while
GetTargetPowers fails toward 0 power. No kernel-memory disclosure, no write primitive, no panic
expected (both reads land in the mapped kernel stack frame).

## Why not reproduced

The QEMU guest has no Atheros NIC (env.txt: no 0x168c device, no ath module); the trigger data is in
the card's serial EEPROM, read at if_ath attach. Following the DF-1308/1309/3960 convention (all
rated Low, AV:P, hardware-gated) this is recorded inconclusive with source-level certainty.

## Fix validation

not_testable (no hardware). fix.diff: early-out in both callers when the count is zero (fail-safe:
MAX_RATE_POWER is already the initialized twiceMaxEdgePower; target powers zeroed by M_ZERO), plus a
defensive listSize==0 guard in GetLowerUpperValues.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.