{
  "finding_id": "DF-3977",
  "verdict": "inconclusive",
  "impact": "none (demonstrated); real = uninit/2-byte stack OOB read + possible max-power TX programming",
  "reproduce": {
    "build": "n/a — hardware-gated (AR5212-family NIC + zeroed EEPROM target-power/CTL block)",
    "run": "n/a",
    "expected": "garbage pier selection during ar5212SetRateTable; possible MAX_RATE_POWER (63) edge power for the channel"
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:2639",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:2643",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:2500",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:2510",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:2579",
    "sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c:973"
  ],
  "artifacts": ["README.md", "VERDICT.md", "verdict.json", "manifest.json", "fix.diff"]
}