{
  "finding_id": "DF-4723",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ath_tdma_settimers (if_ath_tdma.c:137-189) builds bt_nextdba/bt_nextswba with 32-bit (nexttbtt<<3) - prep (:144-145) while nexttbtt is the full TSF-derived 32-bit TU value from the received beacon (nextslottu = TSF_TO_TU(nextslot>>32, nextslot), :444, passed at :576); the shift truncates at 2^29 TU (~6.2 days of continuous TSF) whereas the HAL wraps nexttbtt itself at 2^22 TU (ar5416_beacon.c:48-50: TU_TO_USEC vs ONE_EIGHTH_TU_TO_USEC) — the three beacon timers wrap inconsistently, and per the in-file comment (:563-569, TODO at :345-353) that leads to stopped timers / instability / SWBA storms: TDMA link DoS on >6-day-old sessions. Arithmetic is certain; runtime repro needs ~6.2 days of radio TSF (impossible in QEMU, no ath NIC).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (shift/type/width analysis + HAL consumer semantics), fix.diff",
  "kernel_refs": ["sys/dev/netif/ath/ath/if_ath_tdma.c:144", "sys/dev/netif/ath/ath/if_ath_tdma.c:145", "sys/dev/netif/ath/ath/if_ath_tdma.c:444", "sys/dev/netif/ath/ath/if_ath_tdma.c:576", "sys/dev/netif/ath/ath/if_ath_tdma.c:345", "sys/dev/netif/ath/ath_hal/ar5416/ar5416_beacon.c:48"],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Upstream-acknowledged unaudited wrap family (in-file TODO). Needs 6+ days continuous TDMA operation; ath_tdma_config resets TSF (HAL_BEACON_RESET_TSF) so only long-lived sessions hit it.",
  "recommended_fix": "Do the TU->1/8TU DBA/SWBA math in 64-bit and truncate once so all timers share a single wrap point",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not kernel-validated: requires ~6.2 days of radio TSF runtime on Atheros hardware in TDMA mode.",
  "fix_evidence": "fix.diff authored against read-only sys/."
}