# VERDICT — DF-4705

**status: inconclusive (hardware/option-gated; runtime confirmation
impossible on the audit guest) · reproduced: 0 · analysis confidence:
certain**

## Was it reproduced?
No. The QEMU audit guest has (all verified this run, see
`guest_session.log`):

1. no Atheros PCI device (`pciconf -l` has no 0x168c vendor);
2. no `ath` interface (`ifconfig -a` → 0);
3. stock `X86_64_GENERIC` has no `ATH_DIAGAPI`/`AH_PRIVATE_DIAG`
   options (grep → 0 matches) and the shipped `if_ath.ko` contains no
   `ath_ioctl_diag` symbol (nm → 0), so the `SIOCGATHDIAG` entry point
   does not exist in the running kernel.

The trigger **builds and runs** on the guest (`CC_EXIT=0`,
`RUN_EXIT=0`, `ioctl → -1 errno=6 ENXIO, no panic`) — proving the
userspace side is correct and the failure is purely the missing
hardware/kernel-option gate, not the PoC.

## Why the finding is real (code trace)
- `sys/dev/netif/ath/ath/if_ath_ioctl.c:174` `void *indata = NULL;`
- `:176` `insize = ad->ad_in_size;` (attacker-controlled, taken
  regardless of flags)
- `:180-192` `indata` is allocated only `if (ad->ad_id & ATH_DIAG_IN)`;
  with the bit clear, `args = indata = NULL` while `argsize = insize = 2`
  is forwarded at `:214` into `ath_hal_getdiagstate()`.
- `sys/.../ar5210/ar5210_misc.c:638` checks only
  `argsize != sizeof(uint16_t)` → passes.
- `:642` `*(const uint16_t *)args` → 2-byte read from address 0 →
  page fault → panic. The read happens while evaluating the call
  arguments of `ath_hal_eepromRead()` regardless of evaluation order;
  the PoC supplies `ATH_DIAG_DYN` so `*result` is a valid kmalloc'd
  buffer — the only NULL deref on the line is `args` (this is the
  discriminator against known DF-1819, whose trigger leaves `*result`
  NULL by omitting DYN).
- Identical deref in the generic fallback `ah.c:904` (compiled without
  AH_PRIVATE_DIAG) — same NULL read reachable on all ath HALs.

## Exploit chain
None — NULL read → controlled panic only (unprivileged local DoS, on
double-gated configurations). No write primitive.

## Fix validation
Not possible on this guest (baseline cannot be triggered without
ar5210 hardware + ATH_DIAGAPI). `fix.diff` is authored from the
line-accurate root cause above; `fix_status: not_testable`.

## Guest state
Guest untouched except `/root/poc/trigger{,.c}` (removed after the
run); no panic, guest stayed up; `guest_dirty: 0`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.