# DF-4361 — select_tuner() checks only the upper bound of tuner_type → negative index would walk tuners[] OOB (hardening; all current callers proven safe)

File: `sys/dev/video/bktr/bktr_tuner.c` (pass 2)
Severity: Info (defense-in-depth) · Confidence: certain (defect certain, impact currently unreachable)

## What

```c
sys/dev/video/bktr/bktr_tuner.c:709  void select_tuner( bktr_ptr_t bktr, int tuner_type ) {
sys/dev/video/bktr/bktr_tuner.c:710      if (tuner_type < Bt848_MAX_TUNER) {     /* only UPPER bound */
sys/dev/video/bktr/bktr_tuner.c:711          bktr->card.tuner = &tuners[ tuner_type ];
sys/dev/video/bktr/bktr_tuner.c:712      } else {
sys/dev/video/bktr/bktr_tuner.c:713          bktr->card.tuner = NULL;
sys/dev/video/bktr/bktr_tuner.c:714      }
```

`tuners[]` is exactly 16 entries (bktr_tuner.c:119-280; NO_TUNER=0 … LG_TPI8PSB12P_PAL=15,
`Bt848_MAX_TUNER == 16`, bktr_tuner.h:65). A negative `tuner_type` passes the check and
stores `&tuners[-1]` (or further back). Consumers then dereference it:
- `tuner->pllControl[band]` / `tuner->bandAddrs[band]` (bktr_tuner.c:825-826, 884-885)
- `bktr->card.tuner->name` in the attach printout (bktr_card.c:1343-1344) → `%s` on a
  wild `char *` read from out-of-bounds rodata → potential kernel fault.

## Caller enumeration (why Info, not higher)

Every reachable caller passes a provably non-negative value:
1. Boot tunable: masked `bt848_tuner & 0xff` (bktr_os.c:470, bktr_card.c:906) → 0..255;
   ≥16 → NULL. (Root-controlled anyway.)
2. `BKTR_OVERRIDE_TUNER` path — compile-time constant, not defined in the build.
3. Signature-table dispatch: single entry `{5, 9, …}` → tuner=9 (bktr_card.c:395-398, 862).
4. GPIO/EEPROM derivation: `tuner_format <= 9` gating 10-entry constant tables
   (bktr_card.c:1128-1152), `switch (((INL(...)>>10)-1)&7)` (bktr_card.c:920-928) —
   all enum constants.
So the OOB is currently unreachable; the defect is the missing lower-bound in a
dispatch function that any future caller (or a future table entry typo'd negative)
would turn into a wild read. Classic CWE-129 hardening.

## Fix

```diff
--- a/sys/dev/video/bktr/bktr_tuner.c
+++ b/sys/dev/video/bktr/bktr_tuner.c
@@ -709,7 +709,7 @@ void    select_tuner( bktr_ptr_t bktr, int tuner_type ) {
-	if (tuner_type < Bt848_MAX_TUNER) {
+	if (tuner_type >= 0 && tuner_type < Bt848_MAX_TUNER) {
 		bktr->card.tuner = &tuners[ tuner_type ];
```

## Verification status

`untested` — requires Brooktree PCI hardware to reach any of this at runtime; the audit
guest has no Brooktree/0x109e PCI device (`pciconf -l` clean), so `/dev/bktr*` never
appears and `select_tuner` cannot execute there. Static caller enumeration above is
exhaustive for this tree.