# DF-4723 — PoC evidence pack

**Finding:** 32-bit `(nexttbtt<<3)` truncation in `ath_tdma_settimers` DBA/SWA
math vs full-range TU nexttbtt — beacon-timer corruption after ~6.2 days of
continuous TSF (the in-file "wrap family" TODO, never audited upstream).

## Contents
- `VERDICT.md` — wrap-point analysis (driver `<<3` at 2^29 TU vs HAL
  `TU_TO_USEC` at 2^22 TU), path:line.
- `verdict.json` — machine verdict (status: untested; needs 6+ days radio).
- `fix.diff` — 64-bit math, single truncation point.

## Reproduce / Expected
Requires ~6.2 days of continuous TDMA operation on Atheros hardware — not
reproducible on the QEMU guest.