# DF-4680 — VERDICT

**Status: REPRODUCED (guest, verbatim-extraction harness) · impact: dos ·
confidence: certain · fix: fixed (validated)**

## What was verified

The three `pPDADCValues[kk++]` loops in
`ar2317getGainBoundariesAndPdadcsForPowers()` — extrapolate-below
(ar2317.c:432-436), main walk (:442-443), extrapolate-above (:452-461) — share
one running index `kk` into `pPDADCValues` with **no bound**. `pPDADCValues`
is `ahp->ah_pcdacTable` (ar2317.c:490), aliased to
`priv->pcdacTable[PWR_TABLE_SIZE_2317=128]` at attach (ar2317.c:729;
`PWR_TABLE_SIZE_2413 = 128`, ah_eeprom_v3.h:282).

The harness compiles the guest's own function bodies (anchor-extracted from
`/usr/src`, md5-verified) against the faithful struct (offsets printed in
build.log: pcdacTable@72, Bank1Data@328, vpdTable_L@472, sizeof=2008) and
drives them with an EEPROM-shaped dataset identical in shape to what the
shared `SetupRawDataset` produces (xpd_mask=0xF, four gains with numVpd=4,
Pmin pattern {0,58,58,58}, TPCRG5 overlap 15 — the mask field is 4 bits,
ar5212phy.h:349).

Observed (run.log, mode 1): kk ran to **168**; cells 128..167 (80 bytes)
landed in `Bank1Data..Bank7Data` (0xAAAAAAAA canary destroyed, values
0x0000..0x007F). The overwritten banks are written to the radio by
`ar2317SetRfRegs` (ar2317.c:190-194) — radio misprogramming at best, crash at
worst. The overflow is intra-object (stays inside the 2008-byte
`ath_hal_malloc` allocation) and written values are clamped (0/127), so there
is no uid0 route; severity Low, consistent with the ar5413/ar2316/ar2413
twins.

## Why the bound cannot hold on legit-looking data

Worst-case per-gain walk = extrapolate-below (`ss` from
`boundary[ii-1]-Pmin[ii]-overlap`, can be ≈ -(63+15)) + main (`maxIndex` ≤
63) + extrapolate-above (up to `63+15-0`). With the minimum-guaranteed sum
3+63+6×15 = 156 > 128 for the last gain alone, and up to 4 gains contributing,
the overflow needs no malformed EEPROM beyond ordinary-looking cal data.

## Fix validation

`fix.diff` = `kk < PWR_TABLE_SIZE_2317` guards on all three loops.
`fix_validate.sh` applies it to a copy of the pristine guest source,
re-extracts verbatim, rebuilds, re-runs: patched mode 1 →
`DF-4680: NO overflow detected` (canary intact). `git apply --check` clean
against `sys/`; never applied to `sys/`.

## Not re-reported

DF-1806 (pass 1, numChannels==0 → idxL/idxR wild reads) — different trigger,
different guard. Siblings DF-4681 / DF-4682 / DF-4683 cover the other defects
in the same function.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.