{
  "finding_id": "DF-4722",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "ath_tdma_update (if_ath_tdma.c:355) looks up rix = rt->rateCodeToIndex[rs->rs_rate] at :407 for a received TDMA beacon and passes it unvalidated to ath_hal_pkt_txtime at :432; rateCodeToIndex is initialized with 0xff sentinels for absent codes (ah.c:573-574) while HAL_RATE_TABLE.info[] holds 64 entries (ah.h:681), so rix==0xff makes pkt_txtime read rates->info[255] (ah.c:291) ~2.3KB beyond the array, and computetxtime re-reads info[0xff] 4+ times with a divide-by-zero possible when the garbage rateKbps lands in [1,124] with an OFDM phy (HALASSERT compiled out). Remote-adjacent (peer beacons once an admin configured a TDMA BSS) but narrow preconditions (rate-table/code mismatch e.g. dynamic-turbo/mode-switch race, TDMA requires macversion>0x78 per if_ath.c:1028) -> Low/likely, consistent with DF-1518. No ath NIC in the QEMU guest -> static trace only.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (sentinel init, table size, unguarded HAL index, panic sub-path), fix.diff",
  "kernel_refs": ["sys/dev/netif/ath/ath/if_ath_tdma.c:407", "sys/dev/netif/ath/ath/if_ath_tdma.c:432", "sys/dev/netif/ath/ath/if_ath_tdma.c:435", "sys/dev/netif/ath/ath_hal/ah.c:291", "sys/dev/netif/ath/ath_hal/ah.c:573", "sys/dev/netif/ath/ath_hal/ah.c:363", "sys/dev/netif/ath/ath_hal/ah.h:681", "sys/dev/netif/ath/ath_hal/ar5212/ar5212_recv.c:276"],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "hw-gated: requires Atheros NIC + admin-configured TDMA BSS + received beacon whose hw rate code is absent from the current rate table. The driver-side ternary at :435 only accidentally avoids rt->info[0xff]; the HAL call is unguarded.",
  "recommended_fix": "Bail out of ath_tdma_update when rateCodeToIndex returns the 0xff sentinel (and add a HAL-side bounds guard in ath_hal_pkt_txtime)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: requires Atheros radio hardware in TDMA mode; not present in the QEMU guest.",
  "fix_evidence": "fix.diff authored against read-only sys/."
}