# DF-4689 -- verdict narrative

## What was claimed
Flat pd-gain curve makes sizeCurrVpdTable==0 -> VpdTable_I[ii][sizeCurrVpdTable-1/-2] uint32-wrap wild reads at row+0x1FFFFFFFE (twin of DF-4622/4650/4662/4682)

## Reproduced?
YES (mode 3 of the shared verbatim-extraction harness, run on the DragonFly guest).

REPRODUCED on the DragonFly guest (verbatim-extraction harness, mode 3): with an EEPROM-shaped dataset of flat pd-gain curves (all deltas 0 -- legal 4-bit EEPROM values, constructible by the stock decoder), sizeCurrVpdTable = Pmax_t2[ii]-Pmin_t2[ii] == 0 makes ar2425.c:465-466 index VpdTable_I[ii][(uint32)0-1] -> element 0xFFFFFFFF -> read at row+0x1FFFFFFFE bytes (+8.59 GB). The SIGSEGV handler asserts si_addr == &VpdTable_I[0][0] + 0x1FFFFFFFE exactly (0xa00478dee) -- the fault is pinned to this line. In-kernel: the wild read lands in the direct map (garbage Vpd_step) or a KVA hole (panic) on every channel set with such a curve (crafted EEPROM, or a flat-calibrated legit card). ar2425 keeps VpdTable_I in kernel static storage (:373), so the wild read is relative to .bss. Exploitation gated on crafted/flat-calibrated EEPROM AR2425 hardware; ceiling is DoS. Twin of DF-4622 (ar5413) / DF-4650 (ar2316) / DF-4662 (ar2413) / DF-4682 (ar2317). Fix validated: clamping the [-1]/[-2] accesses behind sizeCurrVpdTable>=2 removes the fault; patched mode 3 runs to completion.

## Fix validation
Harness-level validation (fix_validate.sh): baseline mode 3 dies with SIGSEGV si_addr exactly &VpdTable_I[0][0]+0x1FFFFFFFE (asserted MATCH); with fixC the mode completes ('no SIGSEGV', minPower computed from real data). No kernel rebuild: no AR2425 hardware on the guest; validated against verbatim-extracted bodies per family methodology.

Decisive evidence: run.log: 'mode 3 ... REPRODUCED: SIGSEGV si_addr=0xa00478dee ... expected wild READ address 0xa00478dee ... MATCH'; fix_run.log: 'PATCHED mode 3 ... no SIGSEGV: function completed on this build'.

## Why no in-kernel run
The guest has no AR2425 NIC and no EEPROM-injection path; the family methodology
(DF-4619..DF-4683, all accepted with the same constraint) compiles the real function
bodies against faithful struct/static layouts and proves the violation with
exact-address faults / canaries / propagation -- equivalent strength for a
hardware-gated defect, and it validates the fix the same way.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.