{
  "finding_id": "DF-4548",
  "poc_id": "DF-4548",
  "status": "untested",
  "reproduced": 0,
  "impact": "Latent MMIO OOB-write primitive (key-cache writes past the 128-entry table into PHY register space); defused in-tree by if_aths ATH_KEYMAX=128 clamp",
  "confidence": "likely",
  "attempts": 0,
  "guest_uname": null,
  "code_hash": null,
  "exploit_chain": [],
  "evidence": "4-bit EEPROM field -> halKeyCacheSize up to 32768 vs AR_KEYTABLE_SIZE=128; every ar5212_keycache bound validates against the attacker value. Structural sibling of DF-4520 (MAXQCU). Crafted-EEPROM precondition; no ath hardware on guest.",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_attach.c:867",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_attach.c:868",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_attach.c:870"
  ],
  "verdict": "not_run: Low/hardware-gated hardening, no pack per contract",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable",
  "fix_evidence": "AH_MIN(val, AR_KEYTABLE_SIZE) clamp in finding markdown"
}