# DF-4649 — ar2316 numPdGainsUsed==0 uint32-wrap wild reads (twin of DF-4620/ar5413)

**PoC**: verbatim-extraction harness, mode 2. Same build as DF-4648
(see that README; the packs are self-contained copies).

## Build (guest, root)

```sh
sh build.sh    # verbatim-extract ar2316.c:251-499 + cc -O2 -Wno-pointer-sign
```

## Run

```sh
./ar2316_harness 2
```

## Expected output

```
mapped wild pages 0x... 0x..., seeded 0x5A5A
mode=2 numPdGainsUsed(ret)=0 minPower=0xd3xx
gainBoundaries[0] = 0x5a5a
pcdacTable[0] = 0x5a5a
minPower out = 0xd3xx     (varies per run: uninit stack)
DF-4649 REPRODUCED: uint32-underflow wild reads at ar2316.c:487/:491 + uninit stack read at :427
```

Exit 0 = reproduced. With `fix.diff` (early return) mode 2 prints
ret=0, gainBoundaries[0]=0x0000, pcdacTable[0]=0xaaaa, minPower=0x7c7c
(sentinel preserved). `run.mode2.{3,4,5}.log` show the uninit-stack
value varying across runs (0xd2d0/0xd360/0xd5a0).

## Threat model

Crafted EEPROM (`xpd_mask == 0` → all `numVpd == 0`) on an AR2316 card;
first channel set after attach executes the wrapped backfill reads at
array +0x1FFFFFFFE (wild KVA read → panic or garbage radio program).