# DF-4682 — VERDICT

**Status: REPRODUCED (guest, verbatim-extraction harness, mode 3) · impact:
dos · confidence: certain · fix: fixed (validated)**

## Root cause

`sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii];` (ar2317.c:438) is `uint32_t`
arithmetic over `int16_t` values. An EEPROM curve whose pwr_t4 points are all
equal (flat calibration — two identical pier powers, delta fields 0) yields
`Pmax_t2 == Pmin_t2`, so `sizeCurrVpdTable == 0`, and:

```c
Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -   /* [0xFFFFFFFF] */
		       VpdTable_I[ii][sizeCurrVpdTable-2]);    /* [0xFFFFFFFE] */
```
(ar2317.c:445-446) — wild **reads** at `row + 0x1FFFFFFFE` bytes. The same
wrap pattern repeats in the extrapolate-above block (:455). Additionally
:427 reads `VpdTable_I[ii][1]`, which `ar2317FillVpdTable` left uninitialized
when the span is 0 (its `while (ii <= 0)` writes only index 0).

## Verification (run.log mode 3)

Four gains, numVpd=4, pwr_t4 all 124 → Pmin=Pmax=62, sizeCurrVpdTable=0. The
harness leaves the wild target unmapped: SIGSEGV with
`si_addr == &vpdTable_I[0][0] + 0x1FFFFFFFE` **exactly** (asserted in the
handler; run.log shows the MATCH line). In-kernel the same address hits the
direct map (garbage `Vpd_step` → extrapolated pdadc values → pcdacTable → 32
PHY writes, :566-573) or a KVA hole (panic).

Flat curves are the mildest trigger of the three ar2317 siblings — no
malformed EEPROM needed, just equal calibrated power points.

## Fix validation (fix_run.log, fixC section)

`fix.diff`: `if (sizeCurrVpdTable >= 2) { ...existing Vpd_step math... } else
Vpd_step = 1;` plus `vpdLastIdx = (sizeCurrVpdTable >= 1) ? sizeCurrVpdTable-1
: 0` for the extrapolate-above reference. Patched mode 3 completes with
minPower=0x003e (= 62, the flat curve's Pmin — sane) and no fault. `git apply
--check` clean; never applied to `sys/`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.