# DF-5030 VERDICT — `untested` (Phase V skipped: Info-severity latent finding)

## Bottom line

`ar5312GetMacAddr()` (sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c:287-309)
copies 6 bytes from `((struct ar531x_config *)ah->ah_st)->board->wlanXMac`
with **no NULL check, no `AR531X_BD_MAGIC` validation, no bounds check** — a
genuine validation gap that on a MIPS AR5312/AR231x SoC build with missing or
corrupt flash board-data turns into a wild-pointer kernel read whose result
(the interface MAC) is exposed to unprivileged users via `ifconfig`, or a
panic. **It is not exploitable on any standard DragonFly build because the
file is not compiled at all** — proven three ways (sys/conf/files,
ath_hal kmod Makefile, and 0 ar5312 symbols in the shipped ath_hal.ko and
static kernel on the audit guest — see reachability.log).

## Why no runtime PoC (status `untested`, not `not_reproduced`)

The trigger requires (a) a kernel built with the ar5312 HAL wired in (no
build target does this today) and (b) AR5312-class SoC hardware with
attacker-influenced flash. The audit guest is x86_64 with the standard
X86_64_GENERIC kernel; the cited path is dead at build time, so there is
nothing to run. This is a *code-inspection* finding with certain confidence
about the code, zero runtime exposure.

## Evidence

* `reachability.log` — guest output: `conf-files-ar5312-count: 0`,
  `hal-makefile-ar5312-count: 0`, `symbols-ar5312-in-ath_hal.ko: 0`,
  `symbols-ar5312-in-kernel: 0`.
* Source: ar5312_attach.c:287-309 (the deref+copy), ar5312/ar5312.h:25-30
  (the unchecked casts), ah_soc.h:33-35 (`AR531X_BD_MAGIC` defined, never
  checked here), ah_soc.h:79-90 (the BSP contract the HAL trusts blindly).

## Other classes checked and killed in this file (pass 2)

* EEPROM/flash map OOB — not in this file (ar5312_eeprom.c); attach-side
  reads go through `ar5312EepromRead` indirection only.
* Ini table counts (ar5312_attach.c:125-126) — compile-time tables from
  ar5212.ini; HAL_INI machinery iterates fixed row/col counts; no
  attacker-controlled length.
* ANI params (ar5312_attach.c:36-57) — arrays sized 5/3/3 vs max levels 4/2/2;
  ar5212_ani.c guards every level index (ar5212_ani.c:240,313,331).
* Error unwind UAF/double-free — `bad:` path (278-283) is safe: magic set by
  `ar5212InitState` (85) before any failure; `ar5212RfDetach` NULL-guards
  `ah_rfHal` (ar5212.h:403-406); `ath_hal_free` called exactly once.
* devid table sentinel — `AH_CHIP` (ah_internal.h:97-104) linker-set
  registration; probe table is a complete switch with default `AH_NULL`
  return (311-334); no fallthrough.
* Duplicated VENICE condition (157-160) — upstream logic typo, fails closed
  (attach rejected), no security impact. Dead stores (149-150), cosmetic.

## Fix validation

Not performed — there is no reproducible baseline behavior to validate
against (dead code). `fix.diff` is the reviewer-authored defense-in-depth
patch (NULL + magic validation), untested at runtime by construction.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.