{
  "finding_id": "DF-4540",
  "title": "cxm_tuner: terminator-less band_codes[3]/assignments[17] walks rely on unenforced min_freq/min_channel data invariants - latent rodata OOB-read hazard (Info)",
  "verdict": "untested",
  "impact": "none",
  "reproduce": {
    "build": "./build.sh  (no compile: shell probe)",
    "run": "./run.sh  (sh /root/cxm_env_probe.sh)",
    "expected": "Documents trigger-hardware absence: no vendor-14f1 PCI function, no /dev/cxm* nodes. The hazard itself is static: verified the invariants hold for all 21 tuner entries and all 9 channel tables"
  },
  "kernel_refs": ["sys/dev/video/cxm/cxm_tuner.c:725","sys/dev/video/cxm/cxm_tuner.c:789","sys/dev/video/cxm/cxm_tuner.c:706","sys/dev/video/cxm/cxm_tuner.c:784","sys/dev/video/cxm/cxm.h:619","sys/dev/video/cxm/cxm.h:594"],
  "artifacts": ["README.md","VERDICT.md","cxm_env_probe.sh","build.sh","run.sh","run.log","env.txt","fix.diff","manifest.json","verdict.json"]
}