{
  "finding_id": "DF-4817",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent heap out-of-bounds read (Info severity, hardening). channel_id_to_txp() reads txp_chg->max_channel_idx (offset 4, 2 bytes) from every TXP group entry after checking only entry->data != NULL (if_iwm_phy_db.c:381-390); iwm_phy_db_set_section() accepts firmware lengths of 0..5 bytes, producing allocations smaller than the 6-byte struct iwm_phy_db_chg_txp header (if_iwmreg.h:2298-2301), so the read runs up to 6 bytes past the object (kmalloc(0) returns a valid non-NULL pointer in DragonFly). Currently unreachable: channel_id_to_txps only caller iwm_phy_db_get_section_data is invoked only with IWM_PHY_DB_CFG (if_iwm_phy_db.c:506) and IWM_PHY_DB_CALIB_NCH (:523) - never a channel-group type - and both functions are static to this file. The defect becomes a live hostile-firmware OOB read the moment the CHG lookup path is wired up (as in newer iwlwifi). No runtime test possible: guest lacks Intel Wireless hardware (verified) and the path is dead code in-tree.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (static proof: struct layout, population path, exhaustive call graph); README.md; fix.diff (entry size check)",
  "kernel_refs": [
    "sys/dev/netif/iwm/if_iwm_phy_db.c:372-393",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:312-321",
    "sys/dev/netif/iwm/if_iwm_phy_db.c:396-424",
    "sys/dev/netif/iwm/if_iwmreg.h:2298-2301"
  ],
  "poc_changes": "No seed PoC; no PoC possible (hardware-gated + dead code path).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Distinct from DF-1898 (OOB read of the RX packet buffer during set_sections memcpy) - this reads past a separately-allocated calibration entry, on a different (currently dead) path. Guest hardware check documented in the DF-4816 pack.",
  "recommended_fix": "In channel_id_to_txp, skip entries whose size is smaller than sizeof(struct iwm_phy_db_chg_txp) before reading max_channel_idx",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the missing entry-size check. Not testable on the audit guest: no iwm hardware, and the defective loop is unreachable in the current tree (no caller passes a CHG type).",
  "fix_evidence": "findings/poc/DF-4817/fix.diff"
}