⬢ DragonFlyBSD Kernel Audit
DF-5032 / oob_demo.log
← back to finding ↓ download raw
InvalidGainReadback/5112  GetRfField(bank7, 1, 36, 0)
  words touched: [4]  (max index 4)
InvalidGainReadback/else GetRfField(bank7, 6, 37, 0)
  words touched: [4] [5]  (max index 5)
GetGainFCorrection        GetRfField(bank7, 1, 36, 0)
  words touched: [4]  (max index 4)
GetGainFCorrection        GetRfField(bank7, 4, 32, 0)
  words touched: [3] [4]  (max index 4)

--- max index per call site vs bank7 rows ---
ar5111  (else path)      N(ar5212Bank7_5111)    =  8 rows -> index 5 ok
ar5112  (if path)        N(ar5212Bank7_5112)    = 13 rows -> index 5 ok
ar2413  (else path)      N(ar5212Bank7_2413)    =  3 rows -> index 5 *** OUT OF BOUNDS (reads 2 words past) ***
ar2316  (else path)      N(ar5212Bank7_2316)    =  3 rows -> index 5 *** OUT OF BOUNDS (reads 2 words past) ***
ar5413  (else path)      N(ar5212Bank7_5413)    =  3 rows -> index 5 *** OUT OF BOUNDS (reads 2 words past) ***
ar2317  (else path)      N(ar5212Bank7_2317)    =  3 rows -> index 5 *** OUT OF BOUNDS (reads 2 words past) ***
ar2425/2417 (else)       N(ar5212Bank7_2425)    =  3 rows -> index 5 *** OUT OF BOUNDS (reads 2 words past) ***

verdict: ar5212InvalidGainReadback() reads rfBuf[4] and rfBuf[5]
for every non-5112/5111 radio; their bank 7 has only 3 words.
1