# DF-4619 — ar5413 pdadc walk: unbounded `kk` overflows `pcdacTable[128]` (intra-object heap OOB write)

## What
`ar5413getGainBoundariesAndPdadcsForPowers()` (`sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:397-540`)
writes the final power-detector ADC table through `pPDADCValues[kk++]` at three
sites (:497, :506, :520) with **no bound on `kk`**. `pPDADCValues` is
`ahp->ah_pcdacTable` (ar5413.c:554), i.e. `priv->pcdacTable[PWR_TABLE_SIZE_2413]`
with `PWR_TABLE_SIZE_2413 == 128` (ah_eeprom_v3.h:282) — the first data member
of the heap-allocated `struct ar5413State` (ar5413.c:35-57, allocated at :777).

With a crafted EEPROM (AR_EEPROM_VER5_0 / eepMap==2 dataset; parse path
ah_eeprom_v3.c:823-824 → ar2413SetupRawDataset :633-675 →
ar2413EepromToRawDataset :678-728), the per-gain entry count
(extrapolate-below + in-table + extrapolate-above) sums to more than 128:
worst case `gain0 = b[0]+overlap-Pmin[0]`, `gain_i = 2*overlap + b[i]-b[i-1]`
(both bounded by 63/15), total up to ~168-231 entries. The trailing
`while (kk < 128)` backfill (:531-534) is *skipped* once kk > 128, so the
tail of the table is left stale as well.

Result: `pPDADCValues[128..]` overwrites `Bank1Data/Bank2Data/Bank3Data/Bank6Data`
inside `struct ar5413State` — an intra-object heap overflow (stays inside the
`ath_hal_malloc` allocation; does not cross the slab) that corrupts the RF bank
scratch data programmed to the radio at ar5413Reset time
(ar5413SetRfRegs:249-253 use `priv->Bank*Data`) with EEPROM-influenced 16-bit
values. Triggered on every channel change / reset once the crafted dataset is
in the card's EEPROM.

## Reproduce
On the DragonFly guest (no ath hardware needed — the vulnerable functions are
pure C over EEPROM-shaped data):

```
cd findings/poc/DF-4619
./build.sh        # sed-extracts ar5413.c:288-540 VERBATIM from /usr/src, compiles
./ar5413_harness 1
```

Expected decisive lines (see run.log):

```
DF-4619 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first
clobbered u16 cell 0 bytes past array end, last 79 bytes past (value 0x007f)
  => intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2413=128] into Bank data
```

## Fix validation
`fix.diff` bounds all three write loops with `kk < PWR_TABLE_SIZE_2413`.
Rebuilt from the patched file: mode 1 reports `DF-4619: NO overflow detected`
(bank canary 0xAAAAAAAA intact). See fix_run.log / VERDICT.md.

## Threat model
Attacker supplies an AR5413-family card with crafted EEPROM calibration data
(physical / supply-chain). Impact: kernel heap-object corruption (confined to
the ar5413State allocation) → corrupted radio programming / malfunction, crash
class. No path from unprivileged local user on the host.