{
  "finding_id": "DF-4793",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "panic",
  "confidence": "likely",
  "verdict": "Hardware-gated NULL-deref: ar9287SetPowerCalTable fills pCalBChans/numPiers only in the 2GHz branch, then walks chains unconditionally - a non-2GHz channel passes (NULL,0) into ath_ee_getLowerUpperIndex which derefs pList[0] (ah.c:1273). Reachability chain proven in-tree: DFs ar5416FillCapabilityInfo ORs HAL_MODE_11A under GMODE (ar5416_attach.c:904-914, a DF divergence from FreeBSD), 5GHz edges unconditionally 4915-6100, 5GHz-permissive regdomain EEPROM SKU admits 11a channels, and ar9287SetChannel survives freq>=4800 (modulo, not divide) so the reset reaches the NULL deref. Classic ar9002 family shapes (pdadc/numPdGain/FillVpdTable) structurally ABSENT here (open-loop control). Trigger: privileged channel config or forged EEPROM; fixed-NULL read = panic, no corruption. No ath NIC on the QEMU guest. Early-return guard fix authored.",
  "exploit_chain": "AR9287 + 5GHz-permissive EEPROM regdomain: ifconfig wlan0 create wlandev ath0 mode 11na; channel 149 -> ar9287Reset -> SetPowerCalTable -> ar9287olcGetTxGainIndex(NULL,0) -> ath_ee_getLowerUpperIndex derefs NULL -> kernel panic",
  "evidence": "findings/poc/DF-4793/ (this verdict; full in-tree reachability trace in reviewer notes)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar9002/ar9287_reset.c:68",
    "sys/dev/netif/ath/ath_hal/ar9002/ar9287_reset.c:96-109",
    "sys/dev/netif/ath/ath_hal/ar5416/ar9287_olc.c:114-121",
    "sys/kern/subr_ar9287olc_ah.c:1273",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_attach.c:904-914"
  ],
  "guest_uname": "",
  "code_hash": ""
}