{
  "finding_id": "DF-5038",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Radio-revision rejection in ar9130Attach is compiled out unless AH_DEBUG is defined: in the shipping build (verified empirically - the rejection string is absent from the guests /boot/kernel/ath_hal.ko while ar9130Attach is present) the default switch arm falls through and attach proceeds with an unsupported 5GHz radio rev, programming ar9130.ini RF banks calibrated for a different radio. Fail-open is certain by inspection and shipped-binary proof; runtime reproduction is impossible without AR9130 (Howl) MIPS SoC hardware - the only caller (if_ath_ahb.c) sits on the apb bus, which has no driver anywhere in the x86 tree and no device in the QEMU guest. Family twin of DF-5023 (ar9160, same pattern, same directory). Hardware-gated, no attacker-controlled input, hence Info and untested at runtime by design, not by omission.",
  "exploit_chain": "",
  "evidence": "run.log section 2: not supported by this driver / 5G Radio Chip Rev string counts are 0 in the shipped ath_hal.ko while nm shows ar9130Attach/ar9130Probe (section 1) - the #ifdef AH_DEBUG rejection at ar9130_attach.c:207-214 was not compiled. VERDICT.md walks the fall-through at ar9130_attach.c:196-216 line by line. fix.diff de-ifdefs the rejection and applies cleanly (git apply --check).",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar9001/ar9130_attach.c:196",
    "sys/dev/netif/ath/ath_hal/ar9001/ar9130_attach.c:207",
    "sys/dev/netif/ath/ath_hal/ar9001/ar9130_attach.c:216",
    "sys/dev/netif/ath/ath_hal/ar9001/ar9160_attach.c:222",
    "sys/dev/netif/ath/ath_hal/ah_internal.h:650",
    "sys/dev/netif/ath/ath/if_ath_ahb.c:109",
    "sys/dev/netif/ath/ath_hal/ah_devid.h:77"
  ],
  "poc_changes": "No seed PoC existed; authored gating_check.sh (read-only guest script) + run.sh to prove build gating and the AH_DEBUG-off fail-open on the shipped binaries instead, since runtime triggering requires unavailable AR9130 silicon.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 38,
  "guest_dirty": 0,
  "build_cmd": "n/a (no runtime PoC; read-only guest script)",
  "run_cmd": "sh findings/poc/DF-5038/run.sh",
  "code_hash": "b64b65eca107653f59003cdf305bb61bb7bf81d13d9dac16f94d25ebc6a37d17",
  "notes": "Info-severity hardware-gated finding: Phase V runtime PoC skipped per audit contract (Low/Info); the pack instead carries empirical build-gating proof from the guest. Guest left clean (read-only commands only). Related known findings NOT re-reported: DF-5023 (ar9160 twin), DF-1522 (ah.c EepromDataRead off-by-one, adjacent bound but different file), DF-4913 (v14 eeprom attach leak reachable from this files line 170 error unwind).",
  "recommended_fix": "Un-#ifdef the HAL_ENOTSUPP/goto-bad rejection at ar9130_attach.c:207-214 (keep HALDEBUG; it no-ops in stock builds) so unsupported radio revisions fail closed.",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff (two-line de-ifdef) applies cleanly to sys/ via git apply --check; behavior change is compile-time-only and unconditional on the unsupported-rev path, so no supported-rev path can regress. Not kernel-built/hardware-validated: no AR9130 hardware exists in the audit environment (fix validation mandated only for reproduced memory-corruption findings).",
  "fix_evidence": "fix.diff; CLEAN APPLY from git apply --check recorded in this pack; no baseline run exists to compare (see verdict)."
}