--- mode 1 (DF-4648) ---
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
mode=1 numPdGainsUsed(ret)=4 minPower=0x0000
DF-4648 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first clobbered u16 cell 0 bytes past array end, last 79 bytes past (value 0x007f) => kk ran to 168
  => intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2316=128] into Bank data
--- mode 2 (DF-4649) ---
mapped wild pages 0xa00490000 0x200402000, seeded 0x5A5A
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
mode=2 numPdGainsUsed(ret)=0 minPower=0xd3e0
gainBoundaries[0] = 0x5a5a (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2316.c:487, then written to TPCRG5 by ar2316SetPowerTable:597-602)
pcdacTable[0] = 0x5a5a (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2316.c:491, replicated across the pdadc table / 32 PHY reg writes)
minPower out = 0xd3e0 (uninitialized Pmin_t2[0] stack read at ar2316.c:427; dataset carries no power data)
DF-4649 REPRODUCED: uint32-underflow wild reads at ar2316.c:487/:491 + uninit stack read at :427
--- mode 3 (DF-4650) ---
sizeof(struct ar2316State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_I=1492
REPRODUCED: SIGSEGV si_addr=0x200402872, expected wild address 0x200402872
  (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar2316.c uint32 counter underflow)