# DF-4648 — ar2316 unbounded kk write (twin of DF-4619/ar5413)

**PoC**: verbatim-extraction harness proving the heap OOB write past
`pcdacTable[128]` inside the `ath_hal_malloc`ed `struct ar2316State`.

## Build (on the DragonFly guest, as root)

```sh
cd /root/df2316 && sh build.sh
# awk-extracts ar2316.c:251-499 verbatim from the pristine /usr/src tree
# into ar2316_extracted.inc (249 lines) and compiles:
#   cc -O2 -Wall -Wno-pointer-sign -o ar2316_harness ar2316_harness.c
```

## Run

```sh
./ar2316_harness 1        # DF-4648 (this finding)
./ar2316_harness 2        # DF-4649 (numPdGainsUsed==0 wild reads)
./ar2316_harness 3        # DF-4650 (flat-curve [size-1]/[-2] wrap)
# or: sh run.sh           # all three
```

## Expected output (mode 1)

```
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
mode=1 numPdGainsUsed(ret)=4 minPower=0x0000
DF-4648 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first
 clobbered u16 cell 0 bytes past array end, last 79 bytes past
 (value 0x007f) => kk ran to 168
  => intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2316=128] into Bank data
```

Exit code 0 = reproduced; with `fix.diff` applied (see `fix_validate.sh`)
mode 1 prints `DF-4648: NO overflow detected` and exits 1.

## Threat model

Crafted EEPROM on an AR2316 (Atheros SoC 802.11) card: xpd_mask=0xF,
Pmin pattern {0,58,58,58}, TPCRG5 overlap=15 (4-bit field). First
channel set after attach walks kk to 168 and writes 80 bytes past the
128-entry table into the RF bank scratch. Hardware-gated; DoS-class.