--- mode 1 (DF-4687) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=1 completed minPower=0x0000
DF-4687 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first clobbered u16 cell 0 bytes past array end, last 89 bytes past (value 0x007f) => kk ran to 173
  => intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2413=128] into Bank data (reprogrammed to the radio at ar2425.c:200-210)
--- mode 2 (DF-4688) ---
mapped wild pages 0xa00490000 0xa00475000, seeded 0x5A5A
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
mode=2 completed minPower=0xaaaa
gainBoundaries[0] = 0x5a5a (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2425.c:485, then written to TPCRG5 by ar2425SetPowerTable:557-562)
pcdacTable[0] = 0x5a5a (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2425.c:489, replicated across the pdadc table / 32 PHY reg writes ar2425.c:548-555)
minPower out = 0xaaaa (stale STATIC Pmin_t2[0] read at ar2425.c:431 -- ar2425 keeps Pmin_t2 in .bss, so this is residue of a previous channel's cal, here the 0xAAAA prefill; dataset carries no power data)
DF-4688 REPRODUCED: uint32-underflow wild reads at ar2425.c:485/:489 + stale-static read at :431
--- mode 3 (DF-4689) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
REPRODUCED: SIGSEGV si_addr=0xa00478dee
  expected wild READ address 0xa00478dee (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar2425.c uint32 counter underflow)
--- mode 4 (DF-4686 descending-curve runaway) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
REPRODUCED: SIGSEGV si_addr=0x800479000
  vpd-statics block guard page at 0x800479000 (block end); si_addr is 1552 bytes past block start (sizeof=1552)
  FillVpdTable loop bound (uint16_t)(Pmax-Pmin) = (uint16_t)(84-90) = 65530 entries (131060 bytes) into a 64-wide row
MATCH: unbounded OOB WRITE ran off the end of the function-static VpdTable_* block (guard page)
--- mode 5 (DF-4686 oversized-span write past statics) ---
sizeof(ar2425State)=472 offsetof(pcdacTable)=72 Bank1Data=328 Bank6Data=340 Bank7Data=456 state_guard=0x800476000 | sizeof(vpd_statics)=1552 L=0 I=1024 Pmin_t2=1536 vpd_guard=0x800479000
REPRODUCED: SIGSEGV si_addr=0x800479000
  vpd-statics block guard page at 0x800479000 (block end); si_addr is 1552 bytes past block start (sizeof=1552)
  (VpdTable_I[3][64] first landed on Pmin_t2 -- the kernel-adjacent statics -- then the clobbered bound wrapped and the march continued off the block)
MATCH: unbounded OOB WRITE ran off the end of the function-static VpdTable_* block (guard page)
=== stale-static evidence (mode 2 minPower, 3 runs) ===
mode=2 completed minPower=0xaaaa
minPower out = 0xaaaa (stale STATIC Pmin_t2[0] read at ar2425.c:431 -- ar2425 keeps Pmin_t2 in .bss, so this is residue of a previous channel's cal, here the 0xAAAA prefill; dataset carries no power data)
mode=2 completed minPower=0xaaaa
minPower out = 0xaaaa (stale STATIC Pmin_t2[0] read at ar2425.c:431 -- ar2425 keeps Pmin_t2 in .bss, so this is residue of a previous channel's cal, here the 0xAAAA prefill; dataset carries no power data)
mode=2 completed minPower=0xaaaa
minPower out = 0xaaaa (stale STATIC Pmin_t2[0] read at ar2425.c:431 -- ar2425 keeps Pmin_t2 in .bss, so this is residue of a previous channel's cal, here the 0xAAAA prefill; dataset carries no power data)