# DF-4650 — ar2316 flat-curve [size-1]/[-2] uint32 wrap (twin of DF-4622/ar5413)

**PoC**: verbatim-extraction harness, mode 3. Same build as DF-4648
(see that README; self-contained copies here).

## Build (guest, root)

```sh
sh build.sh    # verbatim-extract ar2316.c:251-499 + cc -O2 -Wno-pointer-sign
```

## Run

```sh
./ar2316_harness 3
```

## Expected output

```
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
REPRODUCED: SIGSEGV si_addr=0x200402872, expected wild address 0x200402872
MATCH: wild OOB read proven (ar2316.c uint32 counter underflow)
```

Exit 0 = reproduced (si_addr exactly equals &vpdTable_I[0][0] +
0x1FFFFFFFE). With `fix.diff` (sizeCurrVpdTable clamped ≥2) mode 3
completes without faulting and prints sane values.

## Threat model

Crafted EEPROM on an AR2316 card: a used pdGain with all-zero
pwr_delta_t2 (flat curve) makes sizeCurrVpdTable==0 →
VpdTable_I[ii][-1]/[-2] wrap to a +8.59 GB wild read at ar2316.c:467-468.