DF-4686 / fix_run.log
===== fixA (DF-4687 kk guards) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.530341227 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.550340965 +0000
--------------------------
Patching file ar2425_fixed.c using Plan A...
Hunk #1 succeeded at 449.
Hunk #2 succeeded at 460.
Hunk #3 succeeded at 471.
done
PATCHES_APPLIED
extract: removed 5 static lines (must be 5)
In file included from ar2425_harness.c:191:
ar2425_extracted.inc: In function 'ar2425FillVpdTable':
ar2425_extracted.inc:55:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2425_harness.c: In function 'main':
ar2425_harness.c:375:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 1 (expect: NO overflow) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=1 completed minPower=0x0000
DF-4687: NO overflow detected
exit=1 (1 == no overflow detected = FIXED)
===== fixB (DF-4688 zero-gain early return) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.558340862 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.558340862 +0000
--------------------------
Patching file ar2425_fixed.c using Plan A...
Hunk #1 succeeded at 428.
Hunk #2 succeeded at 531.
done
PATCHES_APPLIED
extract: removed 5 static lines (must be 5)
In file included from ar2425_harness.c:191:
ar2425_extracted.inc: In function 'ar2425FillVpdTable':
ar2425_extracted.inc:55:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2425_harness.c: In function 'main':
ar2425_harness.c:375:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 2 (expect: early return, no 0x5A5A, sentinel minPower) ---
mapped wild pages 0xa00490000 0xa00475000, seeded 0x5A5A
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=2 completed minPower=0x7c7c
gainBoundaries[0] = 0x0000 (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2425.c:485, then written to TPCRG5 by ar2425SetPowerTable:557-562)
pcdacTable[0] = 0xaaaa (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2425.c:489, replicated across the pdadc table / 32 PHY reg writes ar2425.c:548-555)
minPower out = 0x7c7c (stale STATIC Pmin_t2[0] read at ar2425.c:431 -- ar2425 keeps Pmin_t2 in .bss, so this is residue of a previous channel's cal, here the 0xAAAA prefill; dataset carries no power data)
exit=1
===== fixC (DF-4689 flat-curve guards) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.558340862 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.558340862 +0000
--------------------------
Patching file ar2425_fixed.c using Plan A...
Hunk #1 succeeded at 462.
done
PATCHES_APPLIED
extract: removed 5 static lines (must be 5)
In file included from ar2425_harness.c:191:
ar2425_extracted.inc: In function 'ar2425FillVpdTable':
ar2425_extracted.inc:55:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2425_harness.c: In function 'main':
ar2425_harness.c:375:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 3 (expect: completes, no SIGSEGV at wild address) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=3 completed minPower=0x003e
no SIGSEGV: function completed on this build
exit=1 (1 == no fault = FIXED)
===== fixD (DF-4686 span rejection) alone: residual zero-gain path =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.562340809 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.562340809 +0000
--------------------------
Patching file ar2425_fixed.c using Plan A...
Hunk #1 succeeded at 406.
done
PATCHES_APPLIED
extract: removed 5 static lines (must be 5)
In file included from ar2425_harness.c:191:
ar2425_extracted.inc: In function 'ar2425FillVpdTable':
ar2425_extracted.inc:55:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2425_harness.c: In function 'main':
ar2425_harness.c:375:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 5 with fixD only (expect: SIGSEGV wild read = DF-4688 residual) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=5 completed minPower=0x003a
no SIGSEGV: function completed on this build
exit=1 (residual: skipping the gain leaves zero gains -> fixB needed)
===== fixD + fixB (DF-4686 complete) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.562340809 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.562340809 +0000
--------------------------
Patching file ar2425_fixed.c using Plan A...
Hunk #1 succeeded at 406.
done
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.558340862 +0000
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2425.c 2026-09-22 21:03:53.558340862 +0000
--------------------------
Patching file ar2425_fixed.c using Plan A...
Hunk #1 succeeded at 437 (offset 9 lines).
Hunk #2 succeeded at 540 (offset 9 lines).
done
PATCHES_APPLIED
extract: removed 5 static lines (must be 5)
In file included from ar2425_harness.c:191:
ar2425_extracted.inc: In function 'ar2425FillVpdTable':
ar2425_extracted.inc:55:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2425_harness.c: In function 'main':
ar2425_harness.c:375:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 4 with fixB+fixD (expect: completes) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=4 completed minPower=0x7c7c
no SIGSEGV: function completed on this build
exit=1 (1 == no fault = FIXED)
--- PATCHED mode 5 with fixB+fixD (expect: completes) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=5 completed minPower=0x003a
no SIGSEGV: function completed on this build
exit=1 (1 == no fault = FIXED)
--- PATCHED mode 1/2/3 sanity with fixB+fixD ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=1 completed minPower=0x0000
DF-4687 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first clobbered u16 cell 0 bytes past array end, last 89 bytes past (value 0x007f) => kk ran to 173
=> intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2413=128] into Bank data (reprogrammed to the radio at ar2425.c:200-210)
mapped wild pages 0xa00490000 0xa00475000, seeded 0x5A5A
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=2 completed minPower=0x7c7c
gainBoundaries[0] = 0x0000 (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2425.c:485, then written to TPCRG5 by ar2425SetPowerTable:557-562)
pcdacTable[0] = 0xaaaa (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2425.c:489, replicated across the pdadc table / 32 PHY reg writes ar2425.c:548-555)
minPower out = 0x7c7c (stale STATIC Pmin_t2[0] read at ar2425.c:431 -- ar2425 keeps Pmin_t2 in .bss, so this is residue of a previous channel's cal, here the 0xAAAA prefill; dataset carries no power data)
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
REPRODUCED: SIGSEGV si_addr=0xa00478dee
expected wild READ address 0xa00478dee (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar2425.c uint32 counter underflow)