# DF-5113 — Spectral scan permanently disables radar-detect hardware; no restore path (Info / hardening)

File: `sys/dev/netif/ath/ath_hal/ar5416/ar5416_spectral.c`
Severity: Info (latent; see VERDICT.md) · Bucket: base:dev · Pass 2 (GLM 5.3)

## What

`ar5416PrepSpectralScan()` (ar5416_spectral.c:75-81) is invoked on every
`ar5416ConfigureSpectralScan()` (:88), `ar5416StartSpectralScan()` (:193) and
`ar5416RestoreSpectralConfig()` (:234). It calls `ar5416DisableRadar()`
(:47-73), which:

 * maxes the radar RSSI/height detection thresholds
   (`AR_PHY_RADAR_0_RRSSI`/`AR_PHY_RADAR_0_HEIGHT`, :56-61),
 * clears `AR_PHY_RADAR_0_ENA` — hardware radar detection OFF (:63),
 * clears `AR_PHY_RADAR_EXT_ENA` (:67-68),
 * ORs bit 13 into `AR_RX_FILTER` (:70-72) — never cleared either.

`ar5416StopSpectralScan()` (:205-218) clears only the spectral ENA/ACTIVE bits
and the `AR_PHY_ERR_RADAR` mask bit; it restores **none** of the radar state,
and no reachable in-tree path re-enables radar afterwards (the only
`ath_hal_enabledfs()` callers are inside `#if 0` blocks in
`sys/dev/netif/ath/ath_dfs/null/dfs_null.c:104-148`).

## Why Info (not higher)

 * Reachable only on AR9280/AR9285/AR9287 NICs
   (`halSpectralScanSupport = AH_TRUE` only in ar9280/9285/9287_attach.c;
   ar5416_attach.c:954 sets it AH_FALSE).
 * In this tree radar detection is non-operational anyway — the only DFS
   module compiled is the null stub, whose `ath_dfs_radar_enable()` body is
   `#if 0`'d out and returns 0 unconditionally.
 * On a stack with a real DFS module (upstream FreeBSD HAL lineage), an
   unprivileged `SIOCGATHSPECTRAL` (missing priv check, DF-2081)
   `SPECTRAL_CONTROL_START` on a DFS-channel AP would silently defeat radar
   detection until the next channel change — a regulatory/interference
   hazard, not a memory-safety bug.

## PoC status

**Not executed (skipped per contract — Info hardening finding).** No PoC is
possible on the audit guest: it has no AR928x NIC, and the in-tree null-DFS
module makes the "disabled radar detection" state indistinguishable from the
never-enabled state. `verdict.json` carries `status: "untested"`.

## Recommended fix

`ar5416StopSpectralScan()` (or the driver, on scan stop) should restore the
`AR_PHY_RADAR_0`/`AR_PHY_RADAR_EXT`/`AR_RX_FILTER` values captured before
`ar5416PrepSpectralScan()` clobbered them — see `fix.diff`.