DF-4324
ath_rate_get_static_rix() returns sc_rixmap[ucastrate] without validating the 0xff not-found sentinel — sn->static_rix=255 flows into rt->info[255] out-of-bounds reads (ni_txrate assignment and sample_stats sysctl print)
Summary
The comment claims the static rate index is only set on successful lookup, but the function returns the raw sc_rixmap value (memset 0xff, only filled for table rates) - a fixed rate matching a node-negotiated rate yet absent from the table yields static_rix=255. findrate is saved by a clamp, but the ni_txrate assignment and the sample_stats sysctl print index rt->info[255] - OOB reads ~1.8KB past the static-const table. Requires root config + hostile-AP cooperation. Sentinel-check fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4324 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 137 B | ↓ raw | |
| verdict.json | file | 901 B | view raw |
README.md
file
↓ download raw
DF-4324
Hardware-gated finding - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: see pass-2 result block
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
see pass-2 result block
source-only
per-fix-DF-4324
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; full path:line trace in pass-2 result block
Verdict
source-verified; hardware-gated (no ath NIC / no runtime detach on audit guest)
No comments yet.