# DF-4881 VERDICT

**Status: inconclusive** (guest has no Atheros hardware; the defect is
proven statically with the same rigor as its amrr twin DF-4850).

## What was verified
- The type confusion is in the source, unconditionally:
  `on_tx_rate0..3` are assigned `rt->info[...].rateCode` at onoe.c:221,
  :237, :246, :254 and stored into `rc[0..3].rix` at onoe.c:143-146.
  `ath_rc_series.rix` is documented "ratetable index, not rate code"
  (if_athrate.h:91).
- The caller's correct `rc[0].rix` (set at if_ath_tx.c:1392 from
  `ath_rate_findrate`'s `on_tx_rix0`) is clobbered by onoe.c:143.
- Downstream index-derefs of `bfs_rc[].rix` confirmed at:
  if_ath_tx.c:1073 (`rt->info[rix].phy`),
  if_ath_tx.c:1133-1135 (`spAckDuration`/`lpAckDuration`),
  if_ath_tx.c:1298 (`controlRate`),
  if_ath_tx_ht.c:588 (`series[i].Rate = rt->info[rc[i].rix].rateCode`).
- OOB reachability on 11n HALs: HT rateCode values 0x80-0x8f (128-143;
  ar5416_phy.c:80ff) vs `HAL_RATE_TABLE.info[64]` (ah.h:681) → up to
  ~80 entries past the table.
- Trigger: every mrr frame (`bfs_ismrr && try0 != ATH_TXMAXTRY`,
  if_ath_tx.c:1396-1397); onoe always sets try0=4 on sc_mrretry parts
  (onoe.c:233).

## Guest environment
No Atheros NIC (pciconf: only virtio vgapci, env.txt); onoe module not
shipped (ath_rate.ko = sample). The ath TX path cannot be entered.

## Impact ceiling
Heap OOB read (bounded, read-only) whose garbage output is programmed into
TX descriptors → wrong ACK/RTS durations, wrong protection rate decisions,
mis-programmed 11n rate scenarios (protocol misbehavior / link
degradation). No confidentiality impact. Low severity, matching DF-4850.

## Fix validation
Not possible on this guest. fix.diff authored against the read-only tree.
fix_status: not_applicable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.