--- mode 1 (DF-4680) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=1 numPdGainsUsed(ret)=4 minPower=0x0000
DF-4680 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first clobbered u16 cell 0 bytes past array end, last 79 bytes past (value 0x007f) => kk ran to 168
  => intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2317=128] into Bank data (reprogrammed to the radio at ar2317.c:190-194)
--- mode 2 (DF-4681) ---
mapped wild pages 0xa00490000 0xa00475000, seeded 0x5A5A
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=2 numPdGainsUsed(ret)=0 minPower=0xd4b0
gainBoundaries[0] = 0x5a5a (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2317.c:465, then written to TPCRG5 by ar2317SetPowerTable:575-580)
pcdacTable[0] = 0x5a5a (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2317.c:469, replicated across the pdadc table / 32 PHY reg writes)
minPower out = 0xd4b0 (uninitialized Pmin_t2[0] stack read at ar2317.c:405; dataset carries no power data)
DF-4681 REPRODUCED: uint32-underflow wild reads at ar2317.c:465/:469 + uninit stack read at :405
--- mode 3 (DF-4682) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
REPRODUCED: SIGSEGV si_addr=0xa00475dfe
  expected wild READ address 0xa00475dfe (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar2317.c uint32 counter underflow)
--- mode 4 (DF-4683 descending-curve runaway) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
REPRODUCED: SIGSEGV si_addr=0x800476000
  object guard page at 0x800476000 (struct end); si_addr is 2008 bytes past struct start (sizeof=2008)
  FillVpdTable loop bound (uint16_t)(Pmax-Pmin) = (uint16_t)(84-90) = 65530 entries (131060 bytes) into a 64-wide row
MATCH: unbounded OOB WRITE ran off the end of the ar2317State heap object (guard page)
--- mode 5 (DF-4683 oversized-span write past object) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
REPRODUCED: SIGSEGV si_addr=0x800476000
  object guard page at 0x800476000 (struct end); si_addr is 2008 bytes past struct start (sizeof=2008)
MATCH: unbounded OOB WRITE ran off the end of the ar2317State heap object (guard page)
=== uninit-stack variance (mode 2 minPower, 3 runs) ===
mode=2 numPdGainsUsed(ret)=0 minPower=0xd680
minPower out = 0xd680 (uninitialized Pmin_t2[0] stack read at ar2317.c:405; dataset carries no power data)
mode=2 numPdGainsUsed(ret)=0 minPower=0xd6a0
minPower out = 0xd6a0 (uninitialized Pmin_t2[0] stack read at ar2317.c:405; dataset carries no power data)
mode=2 numPdGainsUsed(ret)=0 minPower=0xd520
minPower out = 0xd520 (uninitialized Pmin_t2[0] stack read at ar2317.c:405; dataset carries no power data)