DF-4662 — ar2413: flat EEPROM power curve → VpdTable_I[ii][sizeCurrVpdTable-1/-2] wild reads

Twin of DF-4622 (ar5413) / DF-4650 (ar2316). If a pd gain's EEPROM curve is flat (all pwr deltas 0 ⇒ pwr_t4 = {124,124,124,124} ⇒ Pmax_t2 == Pmin_t2) then sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii] is 0 (ar2413.c:457) and

Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -   /* ar2413.c:464 */
                       VpdTable_I[ii][sizeCurrVpdTable-2]);   /* ar2413.c:465 */

wraps the uint32 index to 0xFFFFFFFF / 0xFFFFFFFE ⇒ reads at row + 0x1FFFFFFFE bytes (+8.59 GB). A single-step curve (sizeCurrVpdTable==1) wraps the -2 term identically. All-legal 4-bit EEPROM values; HALASSERT is compiled out in release.

Build

On the DragonFly guest: cd /root/df2413 && sh build.sh (shared harness, see DF-4660 pack).

Run

./ar2413_harness 3        # mode 3 = this finding

Expected

REPRODUCED: SIGSEGV si_addr=0x20040286a, expected wild address 0x20040286a
  (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2
   => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar2413.c uint32 counter underflow)

The SIGSEGV handler asserts si_addr == &vpdTable_I[0][0] + 0x1FFFFFFFE exactly — pinning the fault to ar2413.c:464.

Fix validation

sh fix_validate.sh (fixA+B+C): with sizeCurrVpdTable clamped to ≥2, patched mode 3 completes with no fault (garbage-but-in-bounds Vpd_step).

DF-4662 — VERDICT

REPRODUCED (impact: dos — wild KVA read on every channel set with a flat curve; hardware-gated trigger)

Method

Same verbatim-extraction harness as DF-4660 (real ar2413.c:245-496 bodies, faithful struct ar2413State). Mode 3 crafts four used pd gains with FLAT EEPROM curves — all pwr_delta_t2 zero is a fully legal EEPROM shape — so Pmax_t2 == Pmin_t2 == 62 and sizeCurrVpdTable == 0 for every gain (ar2413.c:457).

Result (run.log, stable across two baseline runs)

The reads at ar2413.c:464-465 index VpdTable_I[ii][(uint32)0-1] / [(uint32)0-2] ⇒ element indices 0xFFFFFFFF / 0xFFFFFFFE ⇒ byte offsets +0x1FFFFFFFE / +0x1FFFFFFFC from the row base. Left unmapped, the process takes SIGSEGV with si_addr exactly equal to &vpdTable_I[0][0] + 0x1FFFFFFFE (0x20040286a), asserted inside the handler — the fault is pinned to this line, not incidental:

REPRODUCED: SIGSEGV si_addr=0x20040286a, expected wild address 0x20040286a
MATCH: wild OOB read proven (ar2413.c uint32 counter underflow)

In the kernel the same address lands in the direct map (garbage Vpd_step feeds the extrapolated PDADC values programmed to the radio at ar2413.c:471-479 → ar2413.c:586-593) or in a KVA hole → panic on every channel change with such a curve (crafted EEPROM, or a flat-calibrated legitimate card). sizeCurrVpdTable==1 (single-step curve) wraps the -2 term identically.

Exploitation ceiling

Crafted EEPROM on AR2413 hardware; wild read → panic or garbage radio programming. No write primitive, no exfil, no uid0 route.

Fix validation (fix_run.log)

fix.diff clamps sizeCurrVpdTable to ≥2 before the reads (keeps them in-row; Vpd_step then derives from in-bounds cells). Patched mode 3 completes without faulting. git-apply verified against the pristine tree.

NOT re-reported

DF-1796 (numChannels==0) and DF-4661 (numPdGainsUsed==0 — same uint32-underflow class, different trigger and guard) are distinct.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.