# DF-4682 — ar2317: flat pd-gain curve → sizeCurrVpdTable-1/-2 uint32 wrap

Twin of DF-4622 (ar5413) / DF-4650 (ar2316) / DF-4662 (ar2413), verified for
`sys/dev/netif/ath/ath_hal/ar5212/ar2317.c`.

## Build

Same harness as DF-4680: `cd /root/df2317 && sh build.sh`

## Run

```
./ar2317_harness 3
```

## Expected (baseline)

```
REPRODUCED: SIGSEGV si_addr=0xa00475dfe
  expected wild READ address 0xa00475dfe (uint32 index wrap ...)
MATCH: wild OOB read proven (ar2317.c uint32 counter underflow)
```

A **flat** EEPROM power curve (all pwr_t4 deltas zero → `Pmax_t2 == Pmin_t2`)
makes `sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii]` (ar2317.c:438, uint32
arithmetic) zero; the Vpd_step computation at :445-446 then reads
`VpdTable_I[ii][sizeCurrVpdTable-1]` and `[sizeCurrVpdTable-2]` — element
indices 0xFFFFFFFF / 0xFFFFFFFE → wild reads at `row + 0x1FFFFFFFE` (+8.59
GB). Left unmapped in userspace, the harness faults at exactly the predicted
address. No malformed EEPROM is even required — degenerate flat cal curves
suffice. (:427 also reads `VpdTable_I[ii][1]`, left uninitialized in this
shape — side observation.)

## Fix validation

`fix.diff` guards the [-1]/[-2] reads with `sizeCurrVpdTable >= 2`
(Vpd_step=1 fallback) and clamps the extrapolate-above last index. Patched
mode 3 (fix_run.log): completes with sane minPower=0x003e, no SIGSEGV.

Not re-reported: DF-1806 (numChannels==0), DF-4681 (zero-gain) — different
triggers, different guards.