# DF-4662 — ar2413: flat EEPROM power curve → VpdTable_I[ii][sizeCurrVpdTable-1/-2] wild reads

Twin of DF-4622 (ar5413) / DF-4650 (ar2316). If a pd gain's EEPROM curve is
flat (all pwr deltas 0 ⇒ pwr_t4 = {124,124,124,124} ⇒ `Pmax_t2 == Pmin_t2`)
then `sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii]` is 0 (ar2413.c:457) and

```c
Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -   /* ar2413.c:464 */
                       VpdTable_I[ii][sizeCurrVpdTable-2]);   /* ar2413.c:465 */
```

wraps the uint32 index to 0xFFFFFFFF / 0xFFFFFFFE ⇒ reads at
`row + 0x1FFFFFFFE` bytes (+8.59 GB). A single-step curve
(sizeCurrVpdTable==1) wraps the `-2` term identically. All-legal 4-bit
EEPROM values; `HALASSERT` is compiled out in release.

## Build
On the DragonFly guest: `cd /root/df2413 && sh build.sh` (shared harness,
see DF-4660 pack).

## Run
```
./ar2413_harness 3        # mode 3 = this finding
```

## Expected
```
REPRODUCED: SIGSEGV si_addr=0x20040286a, expected wild address 0x20040286a
  (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2
   => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar2413.c uint32 counter underflow)
```
The SIGSEGV handler asserts `si_addr == &vpdTable_I[0][0] + 0x1FFFFFFFE`
exactly — pinning the fault to ar2413.c:464.

## Fix validation
`sh fix_validate.sh` (fixA+B+C): with `sizeCurrVpdTable` clamped to ≥2,
patched mode 3 completes with no fault (garbage-but-in-bounds Vpd_step).