# DF-5070 Verification Verdict

**Severity:** Medium · **Impact class:** panic (unprivileged local DoS)
**Method:** sink-level reproduction on the stock guest kernel
(DF-4986/DF-5012/DF-5024 house precedent) + fix compile-validation
against the guest's /usr/src.

## Verdict: REPRODUCED (panic), fix VALIDATED

### The bug (source chain, all lines verified)

`ath_ioctl_spectral()` validates `ad_in_size` for
`SPECTRAL_CONTROL_SET_PARAMS` but never checks that the `ATH_DIAG_IN` flag
was set or that `indata != NULL`:

- `if_ath_spectral.c:184` — `void *indata = NULL;`
- `if_ath_spectral.c:197` — `indata` is only allocated when
  `ad->ad_id & ATH_DIAG_IN`;
- `if_ath_spectral.c:233-236` — the SET_PARAMS arm checks ONLY
  `insize < sizeof(HAL_SPECTRAL_PARAM)` (`ad_in_size` is a fully
  user-controlled struct field, independent of the flag);
- `if_ath_spectral.c:237` — `pe = (HAL_SPECTRAL_PARAM *) indata;` → NULL;
- `if_ath_spectral.c:238` — `ath_hal_spectral_configure(sc->sc_ah, pe)`
  → `ar5416ConfigureSpectralScan()` reads `ss->ss_fft_period`
  (`ar5416_spectral.c:92`) / `ss_period` (`:97`) and
  `ar5416GetSpectralParams` writes through the same pointer
  (`:143` → `:157-167`).

The asymmetry that proves oversight: the SAME switch statement's
`SPECTRAL_CONTROL_ENABLE_AT_RESET` arm explicitly checks
`indata == NULL` and rejects with EINVAL (`if_ath_spectral.c:263-267`).
The dfs_null twin of this bug (`DFS_SET_THRESH`) was already filed as
DF-2052; pass 1 missed the spectral instance.

Reachability (per DF-2081, established): `SIOCGATHSPECTRAL` reaches
`ath_ioctl_spectral` via `ieee80211_ioctl`'s default arm
(`sys/netproto/802_11/wlan/ieee80211_ioctl.c:3516-3523` →
`if_ath_ioctl.c:304-305`) with **no privilege check**, for any user who
can open the wlan interface's control socket, on cards with
`halSpectralScanSupport = AH_TRUE` (AR9280 `ar9280_attach.c:904`, AR9285
`:558`, AR9287 `:457`).

### Reproduction (run.log, panic.txt)

The `fire` call (`ad_id = SPECTRAL_CONTROL_SET_PARAMS` (7) with NO
`ATH_DIAG_IN`, `ad_in_size = 64 ≥ sizeof(HAL_SPECTRAL_PARAM) = 36`)
produced:

```
Fatal user address access from kernel mode from df5070_trigger
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x2      (NULL + offsetof(HAL_SPECTRAL_PARAM, ss_period))
fault code = supervisor read data, page not present
Stopped at df5070_ioctl+0x110: movzwl 0x2(%r14),%ecx
```

Controls in the same run:
- `control` (same ioctl WITH `ATH_DIAG_IN` + 64-byte buffer):
  `rc=0`, dmesg `hal_configure(ah, ss=0xfffff8008976ba40) ...` — the
  identical code path is safe when the flag is present;
- `contrast` (`ENABLE_AT_RESET`, `ad_in_size=4`, no flag): `errno=22`
  — its explicit `indata == NULL` check defends;
- `user-side sizeof(HAL_SPECTRAL_PARAM)=36` printed by the trigger,
  matching the kernel-side `sizeof` print at module load.

### Exploitability ceiling

This is a NULL-deref READ at a fixed small offset (page 0 is not mappable
on this platform), i.e. a reliable unprivileged **panic / local DoS**, not
a corruption primitive — no escalation chain is available. (The known
GET_PARAMS heap overflow DF-2079 remains the corruption-class issue in
this function; it is a different arm and was NOT re-exercised here.)

### Fix validation

1. Behavioral A/B at sink level (`run_fixed_ab.log`): with the single
   added check (`if (indata == NULL) { error = EINVAL; break; }` in the
   SET_PARAMS arm only), the same `fire` call returns
   `rc=-1 errno=22 (EINVAL)`, dmesg shows
   `df5070f: SET_PARAMS rejected: indata == NULL (ATH_DIAG_IN not set)`,
   the guest stays up, and the `control`/`contrast` arms are unchanged.
2. Compile validation (`fix_validation.log`): `fix.diff` applied to the
   guest's `/usr/src/sys/dev/netif/ath/ath/if_ath_spectral.c`;
   `make` in `/usr/src/sys/dev/netif/ath/ath` produced `if_ath.ko`
   (includes `if_ath_spectral.o`) with `-Werror`, 0 warnings. Sources
   restored pristine afterwards (grep markers 0).

### Hardware gate

The real entry (a spectral-capable Atheros NIC) is absent from the QEMU
guest, so the panic was demonstrated on the verbatim control-flow replica
per house precedent; every line of the real path was traced and cited
above. On real AR9280/85/87 hardware the same ioctl from an unprivileged
user reaches the identical dereference (DF-2081's missing-priv premise).

Guest returned to a clean state (fresh `vm.sh reset with-src`, sources
pristine, modules unloaded): `guest_dirty = 0`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.