{
 "finding_id": "DF-4324",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "speculative",
 "impact": "The comment claims the static rate index is only set on successful lookup, but the function returns the raw sc_rixmap value (memset 0xff, only filled for table rates) - a fixed rate matching a node-negotiated rate yet absent from the table yields static_rix=255",
 "verdict": "source-verified; hardware-gated (no ath NIC / no runtime detach on audit guest)",
 "exploit_chain": [],
 "evidence": "source-only; full path:line trace in pass-2 result block",
 "kernel_refs": [
  "sys/dev/netif/ath/ath_rate/sample/sample.c:361"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4324/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "see pass-2 result block",
 "fix_evidence": "source-only"
}