# DF-4722 — PoC evidence pack

**Finding:** `ath_tdma_update` passes the 0xff sentinel from
`rateCodeToIndex[]` into `ath_hal_pkt_txtime` → OOB read `rates->info[255]`
(64-entry table), possible divide-by-zero panic.

## Contents
- `VERDICT.md` — full path:line mechanism (sentinel init, table size, HAL
  unguarded index, panic sub-path, trigger preconditions).
- `verdict.json` — machine verdict (status: untested; hw-gated).
- `fix.diff` — validate rix in the driver before the HAL call.

## Reproduce / Expected
Needs an Atheros NIC in an admin-configured TDMA BSS receiving a beacon whose
hw rate code is absent from the current rate table (dynamic-turbo / mode
switch corners). Not reproducible on the QEMU guest (no radio).