# DF-4661 — ar2413: numPdGainsUsed==0 → uint32-wrapped wild reads + uninit Pmin_t2[0]

Twin of DF-4620 (ar5413) / DF-4649 (ar2316). If the EEPROM supplies no pd
gain data for a channel (xpd_mask==0 ⇒ every numVpd==0 — the exact shape
`ar2413SetupRawDataset` produces, ah_eeprom_v3.c:656-673), then in
`ar2413getGainBoundariesAndPdadcsForPowers()`:

* `numPdGainsUsed` stays 0; `HALASSERT(1 <= numPdGainsUsed && ...)`
  (ar2413.c:536) is compiled out in release (AH_ASSERT undefined,
  ah_internal.h:665-676) and the caller never checks the return;
* ar2413.c:424 `*pMinCalPower = Pmin_t2[0]` reads uninitialized stack
  (Pmin_t2[] is only written when numVpd>0);
* ar2413.c:484 `pPdGainBoundaries[ii-1]` with ii==0 — ii is uint32_t ⇒
  element index 0xFFFFFFFF ⇒ read at `gb + 0x1FFFFFFFE` bytes (+8.59 GB),
  a WILD read, not a 2-byte under-read;
* ar2413.c:488 `pPDADCValues[kk-1]` with kk==0 — same wrap from the
  pcdacTable base.

In-kernel the wild read lands in the direct map (garbage propagates into
AR_PHY_TPCRG5 via ar2413SetPowerTable:595-600 and into the 32 PHY register
writes at ar2413.c:586-593) or in a KVA hole (panic).

## Build
On the DragonFly guest: `cd /root/df2413 && sh build.sh` (see DF-4660 pack /
shared harness; verbatim kernel bodies + faithful struct).

## Run
```
./ar2413_harness 2        # mode 2 = this finding
```

## Expected
```
gainBoundaries[0] = 0x5a5a   (wild read at gb+0x1FFFFFFFE propagated)
pcdacTable[0]     = 0x5a5a   (wild read at pcdacTable+0x1FFFFFFFE propagated)
minPower out      = 0xd…0    (uninitialized stack; varies run to run:
                              observed 0xd2e0/0xd3b0/0xd620/0xd370)
DF-4661 REPRODUCED: uint32-underflow wild reads at ar2413.c:484/:488
                    + uninit stack read at :424
```
The harness emulates the kernel direct map (mmapping the exact wild pages
+8.59 GB above the arrays and seeding 0x5A5A) so the call completes and the
propagation is observable; the identical wrap arithmetic is proven to fault
in mode 3 (SIGSEGV si_addr == expected wild address).

## Fix validation
`sh fix_validate.sh` (fixA+B+C): patched mode 2 returns numPdGainsUsed=0
early, minPower keeps its 0x7c7c sentinel (no uninit read), no 0x5A5A
propagation.