# DF-4712 — ar5211 HAL xmit ops: signed/negative tx-queue index reaches `ah_txq[q]` and unchecked MMIO (ar5211 analogue of DF-4519)

**File:** `sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c` (pass 2, GLM 5.3)
**Severity:** Low (latent — no unprivileged trigger today) · **Confidence:** certain (code pattern) · **Bucket:** base:net

## Build / Run

This finding is **hardware-gated** (requires an Atheros AR5211-family NIC to
reach any HAL xmit op at runtime; the audit QEMU guest has none — verified:
`pciconf -l | grep -i ath` → empty). Per the DF-4519/DF-2201 HW-gated protocol
there is no runtime PoC; the defect is source-verified and the fix is
build-validated against the guest kernel:

```sh
# guest (root):
cd /usr/src && patch -p1 < /tmp/df4712_fix.diff
make nativekernel KERNCONF=X86_64_GENERIC     # rc=0, -Werror (build.log)
```

Expected: `ar5211_xmit.o` compiles into the kernel with real runtime q checks;
behavior on this guest is otherwise unchanged (no ath hardware present).

## What to look at

* `VERDICT.md` — full narrative, reachability analysis, killed candidates.
* `build.log` — full untrimmed nativekernel log (`BUILD_RC=0`).
* `fix.diff` — runtime q validation for the five exported xmit ops + signed-q
  rejection in `ar5211SetTxQueueProps`/`ar5211GetTxQueueProps`.
* `env.txt` — guest uname, AH_ASSERT absence in X86_64_GENERIC, no-ath proof.