# DF-4622 — ar5413 flat-curve path: `sizeCurrVpdTable-1/-2` uint32 wrap → **+8.6 GB wild read**

## What
`ar5413getGainBoundariesAndPdadcsForPowers()` computes
`sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii]` (ar5413.c:501) — the half-dB
span of the current pd gain's power curve. If the EEPROM curve is **flat**
(all `pwr_delta_t2` for the gain are 0) the span is 0; a single delta of 1
gives span 1. Then:

```c
Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -   /* :508 */
                       VpdTable_I[ii][sizeCurrVpdTable-2]);   /* :509 */
```

`sizeCurrVpdTable` is **uint32_t**: `0-1` wraps to 0xFFFFFFFF and `0-2` to
0xFFFFFFFE → element offsets ×2 = **+0x1FFFFFFFE / +0x1FFFFFFFC bytes
(+8.59 GB)** from the `vpdTable_I` row inside the heap-allocated
`struct ar5413State` (last member, ar5413.c:55-56).

In the kernel this reads KVA ~8.6 GB above the RF private state: mapped RAM →
garbage `Vpd_step` (wrong pdadc extrapolation programmed to hardware);
unmapped hole → **page fault → panic**. It also silently precedes/coexists
with the DF-4619 kk overflow (this read happens inside the same gain loop).

A flat curve is not even necessarily malicious — a marginally-programmed
legit card with a single flat pd gain hits this on every channel set.

## Reproduce
```
cd findings/poc/DF-4622
./build.sh && ./ar5413_harness 3
```
Expected decisive lines (run.log):
```
REPRODUCED: SIGSEGV si_addr=0x200402892, expected wild address 0x200402892
  (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar5413.c uint32 counter underflow)
```
The asserted equality `si_addr == &vpdTable_I[0][0] + 0x1FFFFFFFE` pins the
fault to exactly this code path.

## Fix validation
`fix.diff` clamps `sizeCurrVpdTable` to ≥2 before the reads. Patched run:
mode 3 completes with no SIGSEGV (clamp holds; residual in-row stale values
are memory-safe). See fix_run.log.