--- extracted      253 lines from /usr/src/sys/dev/netif/ath/ath_hal/ar5212/ar5413.c ---
In file included from ar5413_harness.c:133:
ar5413_extracted.inc: In function 'ar5413FillVpdTable':
ar5413_extracted.inc:55:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
  uint16_t ii, jj, kk;
               ^~
ar5413_harness.c: In function 'main':
ar5413_harness.c:248:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
   *(uint16_t *)((char *)state_storage.pcdacTable +
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           0x1FFFFFFFEull) = 0x5A5A;
           ~~~~~~~~~~~~~~~
build OK: ar5413_harness
=== DF-4619 mode: unbounded kk pdadc walk ===
sizeof(struct ar5413State)=2040 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1524
mode=1 numPdGainsUsed(ret)=4 minPower=0x0000
DF-4619 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first clobbered u16 cell 0 bytes past array end, last 79 bytes past (value 0x007f)
  => intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2413=128] into Bank data
exit=0
=== DF-4620 mode: numPdGainsUsed==0 ===
mapped wild pages 0xa00490000 0x200402000, seeded 0x5A5A
sizeof(struct ar5413State)=2040 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1524
mode=2 numPdGainsUsed(ret)=0 minPower=0xd3e0
gainBoundaries[0] = 0x5a5a (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar5413.c:528, then written to TPCRG5 by ar5413SetPowerTable:639-644)
pcdacTable[0] = 0x5a5a (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar5413.c:532, replicated across the pdadc table / 32 PHY reg writes)
minPower out = 0xd3e0 (uninitialized Pmin_t2[0] stack read at ar5413.c:468; dataset carries no power data)
DF-4620 REPRODUCED: uint32-underflow wild reads at ar5413.c:528/:532 + uninit stack read at :468
exit=0
=== DF-4622 mode: sizeCurrVpdTable==0 uint32 wrap wild read ===
sizeof(struct ar5413State)=2040 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1524
REPRODUCED: SIGSEGV si_addr=0x200402892, expected wild address 0x200402892
  (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar5413.c uint32 counter underflow)
exit=0
=== rerun mode 2 (uninit-stack read varies across runs) ===
mode=2 numPdGainsUsed(ret)=0 minPower=0xd300
minPower out = 0xd300 (uninitialized Pmin_t2[0] stack read at ar5413.c:468; dataset carries no power data)