# DF-4660 — ar2413: unbounded kk pdadc walk writes past pcdacTable[128]

Twin of DF-4619 (ar5413) / DF-4648 (ar2316), same defect in the AR2413 RF
support. `ar2413getGainBoundariesAndPdadcsForPowers()` (ar2413.c:353-496)
fills the 128-entry pdadc table (`pPDADCValues` == `priv->pcdacTable[128]`,
ar2413.c:37/510/747) with three unguarded `pPDADCValues[kk++]` loops
(ar2413.c:453, :462, :476). `kk` is never checked against
`PWR_TABLE_SIZE_2413`; with EEPROM-crafted Pmin/Pmax patterns and the
register-realistic max 4-bit pdGainOverlap (15), the walk for 4 used gains
runs to 168 — 40 uint16 cells (80 bytes) past the array, into the
`Bank1Data..Bank7Data` members of the heap-allocated `struct ar2413State`
(intra-object overflow), which are then programmed to the radio
(ar2413.c:206-210).

## Build
On the DragonFly guest (dfbsd-qemu):
```
cd /root/df2413 && sh build.sh
```
`build.sh` verbatim-extracts ar2413.c:245-496 (GetLowerUpperIndex,
ar2413FillVpdTable, interpolate_signed,
ar2413getGainBoundariesAndPdadcsForPowers) from the pristine guest
/usr/src copy (md5-verified identical to the audit tree) and compiles them
against a faithful `struct ar2413State` (bank rows 1,1,1,27,3 from the
shipped ar5212.ini; verified offsets pcdac@72 Bank1@328 vpdI@1484,
sizeof 2000).

## Run
```
./ar2413_harness 1        # mode 1 = this finding
```

## Expected
```
DF-4660 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first
clobbered u16 cell 0 bytes past array end, last 79 bytes past
(value 0x007f) => kk ran to 168
```
The bank region is 0xAAAAAAAA-prefilled; any cell != 0xAAAA (u16 view) was
clobbered by the overflowing walk. (modes 2/3 of the same harness reproduce
DF-4661/DF-4662.)

## Fix validation
`sh fix_validate.sh` applies fixA/B/C (= this pack's fix.diff + the two
sibling fixes) to a copy of the pristine source, rebuilds, re-runs:
patched mode 1 reports `DF-4660: NO overflow detected`.

Threat model: attacker-crafted EEPROM on an AR2413 (5212-family b/g) card
(physical / supply-chain). Realistic ceiling: radio misprogramming / kernel
panic — no exfil, no uid0 route (values constrained to 0..127, intra-object).