DF-4680 — ar2317: unbounded kk pdadc walk writes past pcdacTable[128]

Twin of DF-4619 (ar5413) / DF-4648 (ar2316) / DF-4660 (ar2413), verified for sys/dev/netif/ath/ath_hal/ar5212/ar2317.c.

Build (on the DragonFly guest)

cd /root/df2317 && sh build.sh

build.sh copies the pristine /usr/src/.../ar2317.c (md5-verified equal to the audit tree), verbatim-extracts lines ~228-477 (GetLowerUpperIndex, ar2317FillVpdTable, interpolate_signed, ar2317getGainBoundariesAndPdadcsForPowers) by anchor, and compiles them against a faithful struct ar2317State (bank rows 1/1/1/30/3 from the shipped ar5212.ini).

Run

./ar2317_harness 1        # this finding
./ar2317_harness 2|3      # siblings DF-4681 / DF-4682 (same pack set)
./ar2317_harness 4|5      # DF-4683
sh run.sh                 # all five modes + uninit-variance repeats

Expected (baseline)

DF-4680 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first
clobbered u16 cell 0 bytes past array end, last 79 bytes past (value 0x007f)
=> kk ran to 168

kk is bounded by nothing in the three pPDADCValues[kk++] loops (ar2317.c:434/:443/:457); with 4 used gains, 63-clamped gain boundaries and TPCRG5 overlap 15 the guaranteed minimum walk is 156 > 128, so the tail of the pdadc table spills 80 bytes into Bank1Data..Bank7Data (RF bank scratch, reprogrammed to the radio at ar2317.c:190-194).

Fix validation

sh fix_validate.sh        # applies fixA..fixD to copies, re-extracts, re-runs

fixA (this pack's fix.diff) caps kk at PWR_TABLE_SIZE_2317 in all three loops → patched mode 1 prints DF-4680: NO overflow detected.

DF-4680 — VERDICT

Status: REPRODUCED (guest, verbatim-extraction harness) · impact: dos · confidence: certain · fix: fixed (validated)

What was verified

The three pPDADCValues[kk++] loops in ar2317getGainBoundariesAndPdadcsForPowers() — extrapolate-below (ar2317.c:432-436), main walk (:442-443), extrapolate-above (:452-461) — share one running index kk into pPDADCValues with no bound. pPDADCValues is ahp->ah_pcdacTable (ar2317.c:490), aliased to priv->pcdacTable[PWR_TABLE_SIZE_2317=128] at attach (ar2317.c:729; PWR_TABLE_SIZE_2413 = 128, ah_eeprom_v3.h:282).

The harness compiles the guest's own function bodies (anchor-extracted from /usr/src, md5-verified) against the faithful struct (offsets printed in build.log: pcdacTable@72, Bank1Data@328, vpdTable_L@472, sizeof=2008) and drives them with an EEPROM-shaped dataset identical in shape to what the shared SetupRawDataset produces (xpd_mask=0xF, four gains with numVpd=4, Pmin pattern {0,58,58,58}, TPCRG5 overlap 15 — the mask field is 4 bits, ar5212phy.h:349).

Observed (run.log, mode 1): kk ran to 168; cells 128..167 (80 bytes) landed in Bank1Data..Bank7Data (0xAAAAAAAA canary destroyed, values 0x0000..0x007F). The overwritten banks are written to the radio by ar2317SetRfRegs (ar2317.c:190-194) — radio misprogramming at best, crash at worst. The overflow is intra-object (stays inside the 2008-byte ath_hal_malloc allocation) and written values are clamped (0/127), so there is no uid0 route; severity Low, consistent with the ar5413/ar2316/ar2413 twins.

Why the bound cannot hold on legit-looking data

Worst-case per-gain walk = extrapolate-below (ss from boundary[ii-1]-Pmin[ii]-overlap, can be ≈ -(63+15)) + main (maxIndex ≤ 63) + extrapolate-above (up to 63+15-0). With the minimum-guaranteed sum 3+63+6×15 = 156 > 128 for the last gain alone, and up to 4 gains contributing, the overflow needs no malformed EEPROM beyond ordinary-looking cal data.

Fix validation

fix.diff = kk < PWR_TABLE_SIZE_2317 guards on all three loops. fix_validate.sh applies it to a copy of the pristine guest source, re-extracts verbatim, rebuilds, re-runs: patched mode 1 → DF-4680: NO overflow detected (canary intact). git apply --check clean against sys/; never applied to sys/.

Not re-reported

DF-1806 (pass 1, numChannels==0 → idxL/idxR wild reads) — different trigger, different guard. Siblings DF-4681 / DF-4682 / DF-4683 cover the other defects in the same function.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.