{
  "finding_id": "DF-4850",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Mechanism proven statically at line level: amrr.c:135-138 stores hardware rateCodes (cached at amrr.c:247-277) into ath_rc_series.rix fields that every consumer dereferences as a rate-table index (if_athrate.h:91 contract), clobbering the correct index placed at if_ath_tx.c:1392; rt->info[rc[i].rix] is then read at if_ath_tx_ht.c:254/260/457-458/579-580 and if_ath_tx.c:1064/1128/1260/1282 on every MRR data frame. Standalone the index stays <= 0x1b < info[64] (amrr selects only legacy rates; sc_rixmap keys HT rows >= 0x80), so it is an in-bounds WRONG-entry read: on 11n HALs legacy rateCodes land on HT MCS rows (ar5416_11ng: 0x1b -> info[27] = MCS15) and flip legacy series to HT rates with CW40/SGI/STBC flags; on pre-11n HALs they read zero-filled table tails yielding ratecode 0. Combined with the known unchecked sc_rixmap 0xff sentinel (DF-1931, same file), the garbage byte becomes the index for a second OOB read past info[64]. Not run: requires an Atheros NIC and a kernel built with ath_rate_amrr (GENERIC uses ath_rate_sample, sys/config/X86_64_GENERIC:266); the QEMU guest has no ath hardware.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4850/VERDICT.md (step-by-step chain with path:line); README.md (wrong-entry table walkthrough); fix.diff (index/code separation, mirrors sample.c)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_rate/amrr/amrr.c:135",
    "sys/dev/netif/ath/ath_rate/amrr/amrr.c:247",
    "sys/dev/netif/ath/ath/if_athrate.h:91",
    "sys/dev/netif/ath/ath/if_ath_tx.c:1392",
    "sys/dev/netif/ath/ath/if_ath_tx.c:1397",
    "sys/dev/netif/ath/ath/if_ath_tx_ht.c:254",
    "sys/dev/netif/ath/ath/if_ath_tx_ht.c:457",
    "sys/dev/netif/ath/ath/if_ath_tx_ht.c:579",
    "sys/dev/netif/ath/ath_hal/ah.h:681",
    "sys/dev/netif/ath/ath_hal/ar5416/ar5416_phy.c:31",
    "sys/dev/netif/ath/ath/if_ath.c:6203"
  ],
  "poc_changes": "No seed PoC existed; pack authored fresh. No runnable trigger is possible without Atheros radio hardware.",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": null,
  "fix_patched_reproduced": null,
  "fix_verdict": "fix.diff authored against read-only sys/ (store per-series indices in amrr_node; return them from ath_rate_getxtxrates). Fix validation requires the hardware tx path (Atheros NIC + ath_rate_amrr kernel) absent from the guest.",
  "fix_evidence": "findings/poc/DF-4850/fix.diff",
  "notes": "Low severity: standalone in-bounds wrong-entry (mis-programmed tx rates/flags; remotely influenceable via peer rate set but needs non-default kernel config). OOB variant piggybacks on DF-1931 (0xff sentinel) which keeps its own fix. DF-1931 attribution double-checked during this pass: the rt->info[] OOB via sc_rixmap sentinel is amrr.cs own copy (amrr.c:246-269); DF-1948 is onoe.cs sibling.",
  "recommended_fix": "Cache per-series rate-table indices in amrr_node and return those from ath_rate_getxtxrates() instead of rate codes (see fix.diff); bounds-check sc_rixmap sentinel per DF-1931.",
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": ""
}