DF-4141 — ar5211GetLowerUpperValues empty-pier-list OOB stack read (DF-3977 ar5211 twin)

File: sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c

What

ar5211GetLowerUpperValues() (ar5211_reset.c:1813) loads const uint16_t listEndValue = *(pList + listSize - 1); at :1818 before any validation of listSize. When the caller passes listSize == 0, this is a 2-byte read below the caller's array (pList[-1]), and the subsequent first-element test at :1829 reads *pList, which is uninitialized whenever the caller did not fill the array.

Kernel reachability (source-certain): ar5211SetRateTable() (ar5211_reset.c:1528-1538) copies a CTL's RD_EDGES_POWER row into uint16_t tempChannelList[NUM_EDGES] on the stack, stopping at the first zero rdEdge; a matched CTL (ee_ctl[i] == cfgCtl != 0, ar5211_reset.c:1357-1361) whose first edge is blanked (rdEdge == 0 && twice_rdEdgePower == 0 — degenerate/corrupt/crafted EEPROM, loaded by readEepromCTLInfo() in ah_eeprom_v3.c:1013) leaves numEdges == 0 and tempChannelList untouched, then calls ar5211GetLowerUpperValues(freq, tempChannelList, 0, ...) at :1537.

Impact: OOB/uninitialized stack values become lowerChannel/upperChannel, selecting a twice_rdEdgePower (twiceMaxEdgePower, :1545-1550) that no longer reflects the regulatory edge limit → TX power programmed above the conformance-test limit for the channel. No kernel write primitive; this is the ar5211 copy of the ar5212 defect filed as DF-3977 (the two HALs carry textually identical helper code).

Build / Run (guest, no hardware needed — proof of primitive)

# build
cc -O2 -Wall -o df4141_oob df4141_oob.c
# run — SUCCESS = prints the SIGSEGV marker and exits 33
./df4141_oob ; echo "exit=$?"     # expect: exit=33

The harness places the array at the start of an mmap'd page whose predecessor page is PROT_NONE, so the pList[-1] load at :1818 faults deterministically. Runs: 3/3 faults (run.log, run.2.log, run.3.log).

Fix validation (harness-level): df4141_oob_fixed.c carries the verbatim function with the exact guard from fix.diff — it returns cleanly with lower=0 upper=0 (fix_run.log, exit=1 "NOT-FAULTED" branch by design). fix.diff additionally git apply --checks cleanly against the sys/ tree (read-only audit; never applied).

Kernel-level manifestation

Hardware-gated: the guest has no AR5211 NIC (0 atheros/prism PCI devices), so the in-kernel path cannot be triggered there. In-kernel effect would be a 2-byte stack OOB read + uninitialized stack read inside ar5211Reset() (the values never leave the HAL; they misprogram radio power).

DF-4141 VERDICT — ar5211GetLowerUpperValues empty-list OOB stack read

Status: inconclusive (kernel manifestation hardware-gated) — primitive PROVEN on guest (3/3 deterministic faults); defect existence certain at source level.

The defect (path:line)

sys/dev/netif/ath/ath_hal/ar5211/ar5211_reset.c

• :1818 const uint16_t listEndValue = *(pList + listSize - 1); → with listSize == 0 reads pList[-1]: 2 bytes BELOW the caller's array. In the kernel this is a stack OOB read below tempChannelList[NUM_EDGES] (declared :1510 in ar5211SetRateTable).
• :1829 if (target < (uint32_t)(*pList * EEP_SCALE - EEP_DELTA)) → reads tempChannelList[0], uninitialized when numEdges == 0 (the fill loop at :1530-1534 wrote nothing).
• Reachability: :1530-1538 — numEdges = i after the break-on-zero-rdEdge loop; a matched CTL (matched at :1357-1361, ee_ctl[i] != 0) whose whole edge row is blank yields numEdges == 0 and the call at :1537 proceeds unconditionally. ee_rdEdgesPower rows are populated from EEPROM by readEepromCTLInfo() (ah_eeprom_v3.c:1013-1104); a blank first pair (rdEdge == 0 && twice_rdEdgePower == 0) survives the fbin2freq pass at :1090-1099 untouched.
• Consequence: lowerChannel/upperChannel become OOB/uninit stack values; twiceMaxEdgePower (:1545-1550) can then be taken from pRdEdgesPower[0].twice_rdEdgePower instead of the correct edge row, or left at the default 63 (63 = 31.5 dBm half-dBm units — above most regulatory limits) → pRatesPower[i] = AH_MIN(twicePower, twiceMaxEdgePower ...) (:1633) no longer bounds to the conformance limit.

This is the ar5211 twin of DF-3977 (ar5212, same helper text) — a separate file, separately fixable.

Sibling defects considered and KILLED (why this pack covers only the empty-list read)

• pList[i + 1] at :1861 reads one-past when i == listSize-1. Proven unreachable for every caller: value is always an integer MHz frequency (or integer pcdac), so target = value*EEP_SCALE is a multiple of 100; pier values are integers, so |pList[i]*100 - target| is a multiple of 100 and the near-match test (< EEP_DELTA=10) fires exactly on equality. Reaching the final iteration requires target >= pList[listSize-1]*100-10 while the early return at :1839 excludes target > listEnd*100+10, and the between-test at i = listSize-2 returns for anything below listEnd*100-10 — leaving only target == listEnd*100, which the near-match catches. (DF's ieee80211_mhz2ieee and the HAL both produce integer frequencies, verified netproto/802_11/wlan/ieee80211.c:1045, ah.c:1427.)
• ar5211GetLowerUpperPcdacs one-past-end walk (:1883-1889, find-loop exits with pChannelData one past the array): only reachable if ar5211GetLowerUpperValues returned 0 for both bounds — same unreachable fall-through as above; with listSize >= 1 every return path yields real pier values which exist 1:1 in ee_dataPerChannel11x (channelValue is assigned from the same array, ah_eeprom_v3.c:868). Killed.
• pcdacTable[64] overflow in ar5211SetPowerTable (:1449-1475): PwrValues are 6-bit EEPROM fields (POWER_MASK 0x3f, ah_eeprom_v3.h:150) scaled by PWR_STEP=50 → max 3150 = PWR_MAX; interpolation is a convex combination; total table writes ≤ 3150/50+1 = 64 = PWR_TABLE_SIZE exactly. Killed.
• tempChannelList[NUM_EDGES=8] target-power fill (:1554-1555): numChannels = ee_numTargetPwr_11a ≤ NUM_TEST_FREQUENCIES = 8 = NUM_EDGES (ah_eeprom_v3.c:939, :964-1002 counter increments only inside the nchan-bounded loop). Exactly fits. Killed.
• CTL walk &ee->ee_rdEdgesPower[i * NUM_EDGES] (:1357-1359): ee_numCtls is the constant NUM_CTLS(16)/NUM_CTLS_3_3(32) (ah_eeprom_v3.c:1147-1150), array is NUM_CTLS_MAX*NUM_EDGES. Killed.
• chan2GHzData[chanIEEE + 19] in ar5211SetChannel (:791-793): DF's mhz2ieee for >2484 MHz is 15 + (freq-2512)/20 (ieee80211.c:1045) and ath_hal_mhz2ieee_2ghz matches (ah.c:1435) → ic_ieee ≤ 26 → index ≤ 45 = last row (46-entry table, ar5211_reset.c:49-97). (FreeBSD's (freq-2511)/5 mapping would overflow here; DragonFly does not use it.) Killed.
• tpcScaleReductionTable[5] index ah_tpScale (:1639): clamped setting <= HAL_TP_SCALE_MIN (ah.c:808). Killed.
• gain-ladder walks (:2033-2068): currStepNum bounded by 0 and numStepsInLadder-1 guards. Killed.
• IQ-cal division (:674-683): guarded iCoffDenom != 0 && qCoffDenom != 0. Killed. (DF-2198 was ar5416's different formula.)

What ran on the guest

• df4141_oob.c: verbatim copy of ar5211GetLowerUpperValues + guard-page placement. Build clean (cc 8.3). 3/3 runs SIGSEGV at the :1818 load, exit 33 (run.log, run.2.log, run.3.log).
• df4141_oob_fixed.c: verbatim function with the exact guard from fix.diff → clean return, lower=0/upper=0, no fault (fix_run.log).
• fix.diff git apply --check clean against sys/ (not applied; sys/ is read-only for the audit).

Why inconclusive (not reproduced/not_reproduced)

The QEMU guest has zero Atheros/Prism PCI devices (checked via pciconf), so the in-kernel path (ar5211Reset → ar5211SetTransmitPower → ar5211SetRateTable) cannot execute. The memory-safety primitive itself is proven deterministically; the kernel-level manifestation (garbage twiceMaxEdgePower → regulatory over-power programming) is established by code reading only. No uid0/panic/leak claim is made; no exploit chain exists beyond wrong radio configuration.

Recommended fix: guard listSize == 0 in ar5211GetLowerUpperValues and skip the edge-interpolation block when numEdges == 0 (fix.diff does both).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.