⬢ DragonFlyBSD Kernel Audit
DF-5032 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-5032",
  "title": "AR5212 RF gain readback reads rfBuf[4..5] past 3-word RF bank 7 for 2413/2316/2317/5413/2425/2417 radios (ar5212InvalidGainReadback)",
  "verdict": "untested",
  "impact": "none",
  "reproduced": false,
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh",
    "run": "sh run.sh",
    "expected": "oob_demo prints the ar5212GetRfField word-walk for each call site; the non-5112 gStep read touches words [4][5] while ar2413/2316/5413/2317/2425 bank7 tables have 3 rows -> '*** OUT OF BOUNDS (reads 2 words past) ***' x5, exit 1. Kernel-path execution skipped: Low severity, requires physical AR5413-on-5GHz hardware absent from the guest."
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_rfgain.c:140",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_rfgain.c:102",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_rfgain.c:111",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212.ini:1870",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212.ini:1886",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212.ini:2166",
    "sys/dev/netif/ath/ath_hal/ar5212/ar2425.c:36",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:35",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_reset.c:1090",
    "sys/dev/netif/ath/ath/if_ath.c:5401"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "oob_demo.c", "oob_demo.log", "build.sh",
    "run.sh", "env.txt", "verdict.json", "manifest.json"
  ]
}