{
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "finding": "DF-4817 — iwm phy_db: channel_id_to_txp() reads max_channel_idx (offset 4 of a 6-byte packed header) from TXP entries without checking entry->size — heap OOB read (<=6 bytes) for firmware lengths 0..5; latent (path dead in-tree)",
  "file": "sys/dev/netif/iwm/if_iwm_phy_db.c",
  "severity": "Info",
  "reproduce": {
    "build": "n/a — hardware-gated (Intel Wireless 7265/8000+ NIC + crafted fw) and the defective path is dead code in the current tree",
    "run": "n/a — audit guest lacks the device (pciconf: no 8086 wireless; no iwm module)",
    "expected": "if the CHG lookup path is ever wired up: heap OOB read of up to 6 bytes per short entry under hostile firmware"
  },
  "kernel_refs": [
    "sys/dev/netif/iwm/if_iwm_phy_db.c:372-393",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:312-321",
    "sys/dev/netif/iwm/if_iwmreg.h:2298-2301"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "verdict.json",
    "fix.diff",
    "manifest.json"
  ]
}