# VERDICT — DF-4361

**status: untested** (hardening finding; hardware-gated path) · **impact: none
demonstrated — defect is real but currently unreachable with an out-of-range value** ·
confidence: certain.

## Reproduced?

No, by design of the finding: `select_tuner()` lacks the lower-bound half of its range
check (bktr_tuner.c:710), so a negative `tuner_type` would store `&tuners[negative]`
into `bktr->card.tuner`, which consumers dereference (`tuner->pllControl[]` /
`tuner->bandAddrs[]` bktr_tuner.c:825-826, 884-885; `card.tuner->name` %s printout
bktr_card.c:1343-1344). An exhaustive caller enumeration for this tree shows every
reachable call site passes a provably non-negative value:

1. boot tunable path — masked `bt848_tuner & 0xff` (bktr_os.c:470, bktr_card.c:905-907);
2. compile-time `BKTR_OVERRIDE_TUNER` — not defined in any build file;
3. signature-table dispatch — single entry {card=5, tuner=9} (bktr_card.c:395-398, 862);
4. EEPROM/GPIO derivation — `tuner_format <= 9` into 10-entry constant tables and
   `&7`-masked GPIO switch (bktr_card.c:920-928, 1128-1152).

Hence Info (defense-in-depth), not a higher severity: the memory-unsafe half of the
index check is missing in a dispatch function where a future caller, table typo, or
config change (`BKTR_OVERRIDE_TUNER`) immediately converts it into a wild kernel read.

Runtime exercise would additionally require Brooktree PCI hardware: the audit guest
(DragonFly 6.5-DEVELOPMENT x86_64, QEMU/KVM) has no 0x109e PCI device (pciconf), so
/dev/bktr* never appears and select_tuner cannot run there.

## Fix validation

not_testable — path needs the PCI card; the fix is a one-sided bound addition
(`tuner_type >= 0 &&`) with no behavior change for any currently-valid value.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)