{
  "finding_id": "DF-4799",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Hardware-bound caps/regulatory defect, no memory corruption: ar9285FillCapabilityInfo inherits the ar5416 GMODE->11A/11NA caps divergence (ar5416_attach.c:904-914) and unconditional 4915-6100 edges, never clamps to 2GHz, and nf_5g limits are left zeroed (XXX no 5ghz values?) - a card whose EEPROM opCapFlags carries the 11A bit (untrusted-EEPROM model, same as DF-4548/4624/4793) exposes 5GHz channels on 2GHz-only silicon; tuning one programs RF2G-only analog banks from 2GHz cal piers and sanitizes every 5GHz NF read against {0,0,0}. Unlike the ar9287 twin DF-4793 there is NO crash: ar9285SetPowerCalTable assigns its pier list unconditionally, so impact is regulatory misoperation/dead radio. Static chain verified line-by-line; no AR9285 on the guest. Clamp-caps+edges fix (+init nf_5g, and fix the shared GMODE block for both twins).",
  "exploit_chain": "EEPROM 11A bit -> 5GHz channels in ic_channels -> channel 36 tunes 2GHz-only banks from 2GHz piers -> out-of-band uncalibrated radio, NF clamped to 0 (no panic)",
  "evidence": "findings/poc/DF-4799/ (this verdict; full static chain in reviewer notes)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar9002/ar9285_attach.c:527",
    "sys/dev/netif/ath/ath_hal/ar9002/ar9285_attach.c:380-384",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_attach.c:904-914",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_attach.c:648-655"
  ],
  "guest_uname": "",
  "code_hash": ""
}