# DF-4622 VERDICT

## Finding
`Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -
                        VpdTable_I[ii][sizeCurrVpdTable-2]);`
at ar5413.c:508-509 inside `ar5413getGainBoundariesAndPdadcsForPowers`.
`sizeCurrVpdTable` (uint32_t, :423/:501) is the current pd gain's power span
in half-dB. A flat EEPROM curve (all `pwr_delta_t2` 0 for the gain — legal
4-bit values from ar2413ReadCalDataset, ah_eeprom_v3.c:449-452) gives span 0;
`0-1`/`0-2` wrap to 0xFFFFFFFF/0xFFFFFFFE → row-relative byte offsets
+0x1FFFFFFFE/+0x1FFFFFFFC → wild read ~8.6 GB above `vpdTable_I` (last member
of the heap `struct ar5413State`, ar5413.c:55-56 → reads past the allocation,
far past).

## Reproduction (guest)
Mode 3 of the verbatim-extraction harness: 4 gains, all curves flat
(pwr_t4 = {124,124,124,124}). First gain hits :508 with span 0:

```
REPRODUCED: SIGSEGV si_addr=0x200402892, expected wild address 0x200402892
MATCH: wild OOB read proven (ar5413.c uint32 counter underflow)
```

`0x200402892 == &vpdTable_I[0][0] (0x402894) + 0x1FFFFFFFE` — exact address
arithmetic asserted in the SIGSEGV handler. (Userspace faults; in-kernel the
direct map usually makes it a garbage read instead, or a panic on a KVA hole.)

## Impact
Crafted (or merely flat-calibrated) EEPROM → wild kernel read on every channel
set: panic-class DoS when the wrapped KVA is unmapped, else garbage
`Vpd_step` → wrong pdadc extrapolation → radio misprogramming. Same
hardware-gated threat model as DF-1766/DF-4619/DF-4620. No exfiltration
channel (value only feeds extrapolation arithmetic and PHY register writes).

## Fix validation
`fix.diff` clamps `sizeCurrVpdTable` to ≥2 before the :508-509 reads (clamp
comment documents the residual in-row stale-value read for span<2 —
memory-safe, correctness only). Patched harness mode 3 completes with **no
SIGSEGV**; values derive from in-row data. See fix_run.log `--- mode 3`.

## Note
Distinct trigger and distinct guard from DF-4620 (:528/:532, zero-gain
backfill) though the same uint32-underflow *class*; distinct from known
DF-1766 (numChannels==0 in GetLowerUpperIndex).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.