Summary

SM(_v _f) macro (ah_internal.h:579) expands to ((_v)<<_f##_S)&(_f). ant_div_control1 uint8_t promoted to signed int. Shifts (ant_div_control1>>1)<<29 at ar9285_diversity.c:98 and (ant_div_control1>>2)<<30 at :99 invoke UB whenever EEPROM antdiv_ctl1 low nibble >=8 (values 8..15): 4<<29=0x80000000 exceeds INT_MAX signed overflow UB; 2<<30=0x80000000 same. Result immediately AND-masked with field mask so actual register bits written correct on every compiler/platform in practice but source not standards-conformant UBSan flags it. antdiv_ctl1 from EEPROM 4-bit field (ah_eeprom_v4k.h:128 135); settable by malicious AR9285 adapter or root EEPROM tools. Only sinks OS_REG_WRITE to PHY registers no kernel memory touched as function of these values. Fix: cast SM operand to uint32_t before shift (ah_internal.h:579 one-line macro fix removes entire class across HAL).