# DF-5038 — ar9130 radio-rev rejection compiled out without AH_DEBUG (fail-open)

**File:** `sys/dev/netif/ath/ath_hal/ar9001/ar9130_attach.c:197-215`
**Class:** Fail-open input validation (family twin of DF-5023, ar9160; same
directory, same inherited Atheros pattern)
**Severity:** Info — hardware-gated (AR9130 SoC only), no attacker-controlled
input reaches it on any supported platform.

## What this pack proves (and does not)

There is **no runtime PoC** for this finding: the rejected input (`ah_analog5GhzRev`)
is read from AR9130 SoC silicon registers (`ar5416GetRadioRev`,
`ar9130_attach.c:196`), and the only caller is the `apb`-bus front-end
`if_ath_ahb.c` — a bus with **no driver anywhere in the x86 tree** and no
hardware inside the QEMU guest. Runtime reproduction requires physical
AR9130 (Howl) MIPS hardware that neither this audit nor the guest has.

What *is* verified, empirically and read-only on the guest:

1. **Build gating:** `ar9130Attach`/`ar9130Probe` are compiled into the shipped
   `/boot/kernel/ath_hal.ko` (module not loaded — no ath hardware present).
2. **The fail-open ships:** the rejection string `"5G Radio Chip Rev ... not
   supported by this driver"` (inside the `#ifdef AH_DEBUG` block,
   `ar9130_attach.c:207-211`) is **absent** from the shipped `ath_hal.ko` —
   proof that `AH_DEBUG` was not defined at build time, i.e. the
   `ecode = HAL_ENOTSUPP; goto bad;` lines were compiled out and the shipped
   attach **fails open** on an unsupported radio revision.
3. No `apb` bus / `0x000b` PCI device exists on the guest (reachability = 0).

## How to reproduce the gating proof

```sh
# guest up (dfbsd-qemu/vm.sh status), then from repo root:
sh findings/poc/DF-5038/run.sh          # prints the three sections above
```

Expected: the two symbol lines under section 1; **0** for both string counts
in section 2; `0 0` in section 3. Full output: `run.log`.