DF-4649 — ar2316 numPdGainsUsed==0 uint32-wrap wild reads (twin of DF-4620/ar5413)

PoC: verbatim-extraction harness, mode 2. Same build as DF-4648 (see that README; the packs are self-contained copies).

Build (guest, root)

sh build.sh    # verbatim-extract ar2316.c:251-499 + cc -O2 -Wno-pointer-sign

Run

./ar2316_harness 2

Expected output

mapped wild pages 0x... 0x..., seeded 0x5A5A
mode=2 numPdGainsUsed(ret)=0 minPower=0xd3xx
gainBoundaries[0] = 0x5a5a
pcdacTable[0] = 0x5a5a
minPower out = 0xd3xx     (varies per run: uninit stack)
DF-4649 REPRODUCED: uint32-underflow wild reads at ar2316.c:487/:491 + uninit stack read at :427

Exit 0 = reproduced. With fix.diff (early return) mode 2 prints ret=0, gainBoundaries[0]=0x0000, pcdacTable[0]=0xaaaa, minPower=0x7c7c (sentinel preserved). run.mode2.{3,4,5}.log show the uninit-stack value varying across runs (0xd2d0/0xd360/0xd5a0).

Threat model

Crafted EEPROM (xpd_mask == 0 → all numVpd == 0) on an AR2316 card; first channel set after attach executes the wrapped backfill reads at array +0x1FFFFFFFE (wild KVA read → panic or garbage radio program).

DF-4649 — ar2316: numPdGainsUsed==0 → uint32 index-wrap wild reads + uninitialized stack (twin of DF-4620/ar5413)

Verdict: REPRODUCED (harness, verbatim kernel code) — impact: dos (hardware-gated)

Root cause

sys/dev/netif/ath/ath_hal/ar5212/ar2316.c — ar2316getGainBoundariesAndPdadcsForPowers():

When the EEPROM raw cal dataset carries no pd-gain data for the channel (xpd_mask == 0 → ar2413SetupRawDataset sets every pDataPerPDGain[j].numVpd = 0, ah_eeprom_v3.c:670-671), the gain-selection loop (ar2316.c:388-425) never increments numPdGainsUsed. HALASSERT(1 <= numPdGainsUsed && numPdGainsUsed <= 3) at ar2316.c:538 is compiled out in release builds (AH_ASSERT undefined, ah_internal.h:665-676), and the caller (ar2316.c:535-537) never checks the return value, so execution falls through to:

• ar2316.c:427 — *pMinCalPower = Pmin_t2[0]; reads uninitialized stack (Pmin_t2[] only written when numVpd > 0); propagates into ahp->ah_txPowerIndexOffset (ar2316.c:581-584).
• ar2316.c:486-489 — backfill pPdGainBoundaries[ii] = pPdGainBoundaries[ii-1]; with ii == 0: ii is uint32_t → element index 0xFFFFFFFF → read at array + 0x1FFFFFFFE bytes (+8.59 GB) — a wild KVA read, not a 2-byte under-read.
• ar2316.c:490-493 — backfill pPDADCValues[kk] = pPDADCValues[kk-1]; with kk == 0: same uint32 wrap from the pcdacTable base.

The garbage boundary then goes to AR_PHY_TPCRG5 (ar2316.c:597-602) and the whole pdadc table (fed by the wild read) to 32 PHY registers (ar2316.c:588-595). In the kernel the +8.6 GB read lands either in the direct map (garbage survives and is programmed to the radio) or in a KVA hole → panic.

Trigger (threat model)

Crafted EEPROM on an AR2316-bearing card: xpd_mask == 0 for the 11b/11g raw dataset (exactly the shape ar2413SetupRawDataset produces). First channel set after attach reaches the broken path.

How it was verified

Verbatim-extraction harness (ar2316_harness.c mode 2) — same method as DF-4648 (function bodies ar2316.c:251-499 compiled verbatim against the faithful struct). The two wild addresses are emulated as kernel direct-map survivors: the exact pages at gb + 0x1FFFFFFFE and pcdacTable + 0x1FFFFFFFE are mmap'd (MAP_FIXED) and seeded with 0x5A5A; the fault flavor (unmapped wild page) is covered by mode 3's SIGSEGV proof for the identical wrap arithmetic.

run.log (decisive lines):

mode=2 numPdGainsUsed(ret)=0 minPower=0xd390
gainBoundaries[0] = 0x5a5a   (wild read at gb+0x1FFFFFFFE, ar2316.c:487)
pcdacTable[0] = 0x5a5a       (wild read at pcdacTable+0x1FFFFFFFE, ar2316.c:491)
minPower out = 0xd390        (uninitialized Pmin_t2[0] stack read, ar2316.c:427)
DF-4649 REPRODUCED: uint32-underflow wild reads at ar2316.c:487/:491 + uninit stack read at :427

The uninitialized-stack read varies run-to-run (0xd2d0 / 0xd360 / 0xd5a0 across run.mode2.3.log, run.mode2.4.log, run.mode2.5.log) — proof it is live stack garbage, not dataset data.

Exploitation ceiling

Hardware-gated (crafted EEPROM). Wild KVA read → panic (KVA hole) or garbage radio programming; the uninit stack value flows only into a tx power offset. No exfiltration channel, no uid0 route.

Fix validation

fix.diff (mirrors the accepted DF-4620 fix): early return 0 when numPdGainsUsed == 0 before the Pmin_t2[0] read and the backfill loops, plus if (numPdGainsUsed == 0) return AH_FALSE; in ar2316SetPowerTable. fix_run.log (PATCHED mode 2): ret=0, gainBoundaries[0]=0x0000, pcdacTable[0]=0xaaaa (canary intact), minPower=0x7c7c (sentinel preserved — the :427 uninit read never executes).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.