# DF-4662 — VERDICT

**REPRODUCED** (impact: dos — wild KVA read on every channel set with a flat curve; hardware-gated trigger)

## Method

Same verbatim-extraction harness as DF-4660 (real ar2413.c:245-496 bodies,
faithful struct ar2413State). Mode 3 crafts four used pd gains with FLAT
EEPROM curves — all pwr_delta_t2 zero is a fully legal EEPROM shape — so
`Pmax_t2 == Pmin_t2 == 62` and `sizeCurrVpdTable == 0` for every gain
(ar2413.c:457).

## Result (run.log, stable across two baseline runs)

The reads at ar2413.c:464-465 index `VpdTable_I[ii][(uint32)0-1]` /
`[(uint32)0-2]` ⇒ element indices 0xFFFFFFFF / 0xFFFFFFFE ⇒ byte offsets
+0x1FFFFFFFE / +0x1FFFFFFFC from the row base. Left unmapped, the process
takes SIGSEGV with `si_addr` **exactly equal** to
`&vpdTable_I[0][0] + 0x1FFFFFFFE` (0x20040286a), asserted inside the
handler — the fault is pinned to this line, not incidental:

```
REPRODUCED: SIGSEGV si_addr=0x20040286a, expected wild address 0x20040286a
MATCH: wild OOB read proven (ar2413.c uint32 counter underflow)
```

In the kernel the same address lands in the direct map (garbage `Vpd_step`
feeds the extrapolated PDADC values programmed to the radio at
ar2413.c:471-479 → ar2413.c:586-593) or in a KVA hole → panic on every
channel change with such a curve (crafted EEPROM, or a flat-calibrated
legitimate card). sizeCurrVpdTable==1 (single-step curve) wraps the `-2`
term identically.

## Exploitation ceiling

Crafted EEPROM on AR2413 hardware; wild read → panic or garbage radio
programming. No write primitive, no exfil, no uid0 route.

## Fix validation (fix_run.log)

fix.diff clamps `sizeCurrVpdTable` to ≥2 before the reads (keeps them
in-row; Vpd_step then derives from in-bounds cells). Patched mode 3
completes without faulting. git-apply verified against the pristine tree.

## NOT re-reported

DF-1796 (numChannels==0) and DF-4661 (numPdGainsUsed==0 — same
uint32-underflow class, different trigger and guard) are distinct.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.