DF-4622 — ar5413 flat-curve path: sizeCurrVpdTable-1/-2 uint32 wrap → +8.6 GB wild read

What

ar5413getGainBoundariesAndPdadcsForPowers() computes sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii] (ar5413.c:501) — the half-dB span of the current pd gain's power curve. If the EEPROM curve is flat (all pwr_delta_t2 for the gain are 0) the span is 0; a single delta of 1 gives span 1. Then:

Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -   /* :508 */
                       VpdTable_I[ii][sizeCurrVpdTable-2]);   /* :509 */

sizeCurrVpdTable is uint32_t: 0-1 wraps to 0xFFFFFFFF and 0-2 to 0xFFFFFFFE → element offsets ×2 = +0x1FFFFFFFE / +0x1FFFFFFFC bytes (+8.59 GB) from the vpdTable_I row inside the heap-allocated struct ar5413State (last member, ar5413.c:55-56).

In the kernel this reads KVA ~8.6 GB above the RF private state: mapped RAM → garbage Vpd_step (wrong pdadc extrapolation programmed to hardware); unmapped hole → page fault → panic. It also silently precedes/coexists with the DF-4619 kk overflow (this read happens inside the same gain loop).

A flat curve is not even necessarily malicious — a marginally-programmed legit card with a single flat pd gain hits this on every channel set.

Reproduce

cd findings/poc/DF-4622
./build.sh && ./ar5413_harness 3

Expected decisive lines (run.log):

REPRODUCED: SIGSEGV si_addr=0x200402892, expected wild address 0x200402892
  (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar5413.c uint32 counter underflow)

The asserted equality si_addr == &vpdTable_I[0][0] + 0x1FFFFFFFE pins the fault to exactly this code path.

Fix validation

fix.diff clamps sizeCurrVpdTable to ≥2 before the reads. Patched run: mode 3 completes with no SIGSEGV (clamp holds; residual in-row stale values are memory-safe). See fix_run.log.

DF-4622 VERDICT

Finding

Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] - VpdTable_I[ii][sizeCurrVpdTable-2]); at ar5413.c:508-509 inside ar5413getGainBoundariesAndPdadcsForPowers. sizeCurrVpdTable (uint32_t, :423/:501) is the current pd gain's power span in half-dB. A flat EEPROM curve (all pwr_delta_t2 0 for the gain — legal 4-bit values from ar2413ReadCalDataset, ah_eeprom_v3.c:449-452) gives span 0; 0-1/0-2 wrap to 0xFFFFFFFF/0xFFFFFFFE → row-relative byte offsets +0x1FFFFFFFE/+0x1FFFFFFFC → wild read ~8.6 GB above vpdTable_I (last member of the heap struct ar5413State, ar5413.c:55-56 → reads past the allocation, far past).

Reproduction (guest)

Mode 3 of the verbatim-extraction harness: 4 gains, all curves flat (pwr_t4 = {124,124,124,124}). First gain hits :508 with span 0:

REPRODUCED: SIGSEGV si_addr=0x200402892, expected wild address 0x200402892
MATCH: wild OOB read proven (ar5413.c uint32 counter underflow)

0x200402892 == &vpdTable_I[0][0] (0x402894) + 0x1FFFFFFFE — exact address arithmetic asserted in the SIGSEGV handler. (Userspace faults; in-kernel the direct map usually makes it a garbage read instead, or a panic on a KVA hole.)

Impact

Crafted (or merely flat-calibrated) EEPROM → wild kernel read on every channel set: panic-class DoS when the wrapped KVA is unmapped, else garbage Vpd_step → wrong pdadc extrapolation → radio misprogramming. Same hardware-gated threat model as DF-1766/DF-4619/DF-4620. No exfiltration channel (value only feeds extrapolation arithmetic and PHY register writes).

Fix validation

fix.diff clamps sizeCurrVpdTable to ≥2 before the :508-509 reads (clamp comment documents the residual in-row stale-value read for span<2 — memory-safe, correctness only). Patched harness mode 3 completes with no SIGSEGV; values derive from in-row data. See fix_run.log --- mode 3.

Note

Distinct trigger and distinct guard from DF-4620 (:528/:532, zero-gain backfill) though the same uint32-underflow class; distinct from known DF-1766 (numChannels==0 in GetLowerUpperIndex).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.