DF-4209
Memory leak of ee_modePowerArray5112[].pChannels allocations when legacyEepromReadContents fails after eepromAllocExpnPower5112 succeeded
Summary
readEepromRawPowerCalInfo5112 allocates pChannels/pDataPerChannel per mode BEFORE eepromExpandPower5112 can fail. On failure the attach frees the HAL_EEPROM struct without the 5112 array cleanup - the detach that would have done it is only installed on success. Bounded leak per probe attempt, accumulating on repeated probe/hot-plug with a malformed EEPROM. Cleanup-on-failure fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4209 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 141 B | ↓ raw | |
| verdict.json | file | 758 B | view raw |
README.md
file
↓ download raw
DF-4209
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block fix
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
see pass-2 result block fix
source-only
per-fix-DF-4209
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; full path:line trace in pass-2 result block
Verdict
source-verified; hardware-gated (no ath NIC / no ISP_TARGET_MODE kernel on audit guest)
No comments yet.