# DF-4624 fix: bail out early when the v4k EEPROM supplies xpdGain == 0
# (numXpdGains == 0), so the tail backfill never runs with k == 0
# (pPDADCValues[-1] OOB read) and the uninitialized minPwrT4[0] stack read
# at :719 never executes.
--- a/sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c
+++ b/sys/dev/netif/ath/ath_hal/ar9002/ar9285_reset.c
@@ -665,6 +665,17 @@ ar9285GetGainBoundariesAndPdadcs(struct ath_hal *ah,
     CHAN_CENTERS centers;
 
     ar5416GetChannelCenters(ah, chan, &centers);
+
+    if (numXpdGains == 0) {
+        /*
+         * The EEPROM supplied xpdGain == 0: no pd gains are selected
+         * (ar9285SetPowerCalTable left numXpdGain == 0).  minPwrT4[]/
+         * maxPwrT4[] would stay uninitialized and the tail backfill
+         * below would execute with k == 0, reading pPDADCValues[-1].
+         */
+        OS_MEMZERO(pPDADCValues, AR5416_NUM_PDADC_VALUES);
+        return;
+    }
 
     /* Trim numPiers for the number of populated channel Piers */
     for (numPiers = 0; numPiers < availPiers; numPiers++) {