⬢ DragonFlyBSD Kernel Audit
DF-4650 / fix_run.log
← back to finding ↓ download raw
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.365463540 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.389463221 +0000
--------------------------
Patching file ar2316_fixed.c using Plan A...
Hunk #1 succeeded at 451.
Hunk #2 succeeded at 462.
Hunk #3 succeeded at 473.
done
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.365463540 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.389463221 +0000
--------------------------
Patching file ar2316_fixed.c using Plan A...
Hunk #1 succeeded at 424.
Hunk #2 succeeded at 549 (offset 1 line).
done
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.365463540 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.389463221 +0000
--------------------------
Patching file ar2316_fixed.c using Plan A...
Hunk #1 succeeded at 473 with fuzz 1 (offset 14 lines).
done
PATCHES_APPLIED
     272 ar2316_extracted.inc
In file included from ar2316_harness.c:145:
ar2316_extracted.inc: In function 'ar2316FillVpdTable':
ar2316_extracted.inc:51:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
  uint16_t ii, jj, kk;
               ^~
ar2316_harness.c: In function 'main':
ar2316_harness.c:260:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
   *(uint16_t *)((char *)state_storage.pcdacTable +
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           0x1FFFFFFFEull) = 0x5A5A;
           ~~~~~~~~~~~~~~~
FIXED_BUILD_OK
=== PATCHED mode 1 (expect: NO overflow) ===
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
mode=1 numPdGainsUsed(ret)=4 minPower=0x0000
DF-4648: NO overflow detected
exit=1 (1 == no overflow detected)
=== PATCHED mode 2 (expect: ret=0, no 0x5A5A propagation, sentinel minPower) ===
mapped wild pages 0xa00490000 0x200402000, seeded 0x5A5A
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
mode=2 numPdGainsUsed(ret)=0 minPower=0x7c7c
gainBoundaries[0] = 0x0000 (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2316.c:487, then written to TPCRG5 by ar2316SetPowerTable:597-602)
pcdacTable[0] = 0xaaaa (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2316.c:491, replicated across the pdadc table / 32 PHY reg writes)
minPower out = 0x7c7c (uninitialized Pmin_t2[0] stack read at ar2316.c:427; dataset carries no power data)
exit=1
=== PATCHED mode 3 (expect: completes, no SIGSEGV at wild address) ===
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
mode=3 numPdGainsUsed(ret)=4 minPower=0x003e
gainBoundaries[0] = 0x003e (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2316.c:487, then written to TPCRG5 by ar2316SetPowerTable:597-602)
pcdacTable[0] = 0xaaaa (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2316.c:491, replicated across the pdadc table / 32 PHY reg writes)
minPower out = 0x003e (uninitialized Pmin_t2[0] stack read at ar2316.c:427; dataset carries no power data)
exit=1