===== stock (audited kernel code) =====
sizeof(HAL_EEPROM) = 6568 (dumped wholesale by HAL_DIAG_EEPROM, incl. 6 kernel heap pointers in ee_u)

2413 raw dataset pChannels[0..3] = 143c 1478 14c8 1671  (EEPROM-chosen pier frequencies)

legacyEepromDiag(EXP_11A) returned 1 on a eepMap==2 (2413) card:
[EXP_11A] *result   = 0x167114c81478143c  *resultsize = 0
[EXP_11A]     -> NON-CANONICAL kernel pointer: copyout() in ath_ioctl_diag() takes a page fault -> PANIC
[EXP_11A]     pointer == pChannels[0..3] as u64: 0x167114c81478143c (match: YES)

legacyEepromDiag(HAL_DIAG_EEPROM) returned 1: dumps all 6568 bytes of HAL_EEPROM
-> bytes [offsetof(ee_u)..] include the live kernel heap pointers of ee_u (info leak)

5-pier variant: pe->numChannels aliases pChannels[4] = 5800 -> *resultsize = 498800 bytes from 0x167114c81478143c

FAIL: non-canonical wild pointer from union confusion CONFIRMED
exit=42

===== with fix.diff applied =====
sizeof(HAL_EEPROM) = 6568 (dumped wholesale by HAL_DIAG_EEPROM, incl. 6 kernel heap pointers in ee_u)

2413 raw dataset pChannels[0..3] = 143c 1478 14c8 1671  (EEPROM-chosen pier frequencies)

legacyEepromDiag(EXP_11A) returned 0 on a eepMap==2 (2413) card:
[EXP_11A] *result   = 0x0000000000000000  *resultsize = 0
[EXP_11A]     -> NULL, copyout skipped (resultsize 0)
[EXP_11A]     pointer == pChannels[0..3] as u64: 0x167114c81478143c (match: no)

legacyEepromDiag(HAL_DIAG_EEPROM) returned 1: dumps all 6568 bytes of HAL_EEPROM (pack-built fixed variant)
-> bytes [offsetof(ee_u)..] include the live kernel heap pointers of ee_u (info leak)

5-pier variant: pe->numChannels aliases pChannels[4] = 5800 -> *resultsize = 0 bytes from 0x0

PASS (fixed): EXP diag codes refused on eepMap!=1 card; no wild pointer produced
exit=0

RESULT: union confusion reproduced on stock, GONE with fix