# DF-4680 — ar2317: unbounded kk pdadc walk writes past pcdacTable[128]

Twin of DF-4619 (ar5413) / DF-4648 (ar2316) / DF-4660 (ar2413), verified for
`sys/dev/netif/ath/ath_hal/ar5212/ar2317.c`.

## Build (on the DragonFly guest)

```
cd /root/df2317 && sh build.sh
```

`build.sh` copies the pristine `/usr/src/.../ar2317.c` (md5-verified equal to
the audit tree), verbatim-extracts lines ~228-477 (`GetLowerUpperIndex`,
`ar2317FillVpdTable`, `interpolate_signed`,
`ar2317getGainBoundariesAndPdadcsForPowers`) by anchor, and compiles them
against a faithful `struct ar2317State` (bank rows 1/1/1/30/3 from the shipped
`ar5212.ini`).

## Run

```
./ar2317_harness 1        # this finding
./ar2317_harness 2|3      # siblings DF-4681 / DF-4682 (same pack set)
./ar2317_harness 4|5      # DF-4683
sh run.sh                 # all five modes + uninit-variance repeats
```

## Expected (baseline)

```
DF-4680 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first
clobbered u16 cell 0 bytes past array end, last 79 bytes past (value 0x007f)
=> kk ran to 168
```

kk is bounded by nothing in the three `pPDADCValues[kk++]` loops
(ar2317.c:434/:443/:457); with 4 used gains, 63-clamped gain boundaries and
TPCRG5 overlap 15 the guaranteed minimum walk is 156 > 128, so the tail of the
pdadc table spills 80 bytes into `Bank1Data..Bank7Data` (RF bank scratch,
reprogrammed to the radio at ar2317.c:190-194).

## Fix validation

```
sh fix_validate.sh        # applies fixA..fixD to copies, re-extracts, re-runs
```

fixA (this pack's `fix.diff`) caps kk at `PWR_TABLE_SIZE_2317` in all three
loops → patched mode 1 prints `DF-4680: NO overflow detected`.