# DF-5032 VERDICT — AR5212 rfgain readback OOB read past 3-word bank 7

**Status: `untested` (kernel impact), defect `certain` (static proof +
arithmetic demo run on the guest).**

## Reproduced or not, and why

* The bounds defect is proven statically and by the index-walk demo
  (`oob_demo.log`, run on the DragonFly guest): `ar5212GetRfField(bank7,
  6, 37, 0)` — ar5212_rfgain.c:140 — touches `rfBuf[4]` and `rfBuf[5]`,
  while every non-5112/5111 RF backend's bank 7 shadow array has only 3
  words (ar5212.ini:1870/1878/1886/2158/2166).
* The kernel path was **not** executed: the audit guest has no Atheros
  hardware (and no 5 GHz-capable 5413 card can exist in it), so
  `ar5212GetRfgain()` cannot run.  Per the audit contract, PoC/Phase-V work
  is skipped for Low-severity, hardware-only findings.

## Reachability (path:line)

ar5212PerCalibrationN (ar5212_reset.c:1085-1094) arms the probe on
5 GHz channels → ar5212RequestRfgain (ar5212_rfgain.c:160-172) → driver
polls ath_hal_getrfgain (if_ath.c:5401) → ar5212GetRfgain
(ar5212_rfgain.c:279-333) → ar5212InvalidGainReadback:140 → OOB read.
Radio gates:

* ar5413: 5 GHz-capable → **live path** on every calibration cycle; the
  read lands in `vpdTable_L` inside the same allocation
  (ar5413.c:35-57; priv from `ath_hal_malloc`, ar5413.c:777) → C-level
  array OOB, no heap violation.
* ar2425/ar2417: `Bank7Data` is the last member (ar2425.c:36-45) → would
  be an 8-byte heap OOB read — but 2.4 GHz-only radios never pass the
  5 GHz gate (ar5212_reset.c:1090-1091).  Dormant.
* ar2413/2316/2317: vpd tables follow Bank7Data (ar2413.c:35-57); 2.4 GHz
  only → dormant, and intra-struct anyway.

## Impact ceiling

`gStep` (garbage) → wrong `loTrig/hiTrig` (ar5212_rfgain.c:147-149) →
misfiring gain-ladder adjustments (ar5212AdjustGain, :187-237) → RF
performance degradation / potential link loss.  The read value is never
exported (no info leak) and never used as an index/pointer (no corruption).
Low severity, CWE-125.

## Fix sketch

Keep the byte-walk inside the shadow arrays: bump the affected RF structs'
`Bank7Data[]` to ≥6 words (harmless extra 12 bytes per radio priv), or gate
ar5212InvalidGainReadback's gStep extraction to radios whose bank-7 layout
actually places bits 33-43 there (5111 only, 8 rows) and treat the newer
radios as "never adjust" (gStep == 0x3f semantics already encode that).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)