{
  "finding_id": "DF-4908",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Hardware-gated (no ath NIC on guest; function needs live bus_dma+HAL): ath_descdma_setups bf-array kmalloc failure path leaves error==0 (from the prior successful alloc_desc), tears everything down at fail3 (unload/free/destroy/memset dd) and returns SUCCESS - every caller proceeds on a zeroed descdma (dd_desc NULL, never-initialized buffer list): first TX/RX = NULL deref/unbounded no-buffer -> panic or hang. Deterministically reachable because hw.ath.rxbuf/txbuf/txbuf_mgmt are unvalidated RWTUN sysctls feeding the int math: huge values force the M_NOWAIT failure, and values where sizeof(ath_buf)*nbuf truncates to a small positive int make the kmalloc SUCCEED small while the setup loop TAILQ_INSERTs far past it (heap OOB writes). Set-error + validate-the-counts fix.",
  "exploit_chain": "root: sysctl hw.ath.txbuf=<huge>; ifconfig ath0 up -> bsize truncation or NOWAIT fail -> fail3 returns 0 -> driver runs on zeroed descdma -> NULL-deref panic (or small-kmalloc OOB walk)",
  "evidence": "findings/poc/DF-4908/ (this verdict; control-flow certainty - error provably 0 at fail3)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath/if_ath_descdma.c:272-278",
    "sys/dev/netif/ath/ath/if_ath_descdma.c:319-324",
    "sys/dev/netif/ath/ath/if_ath_descdma.c:271",
    "sys/dev/netif/ath/ath/if_ath.c:256-274"
  ],
  "guest_uname": "",
  "code_hash": ""
}