DF-4682 — ar2317: flat pd-gain curve → sizeCurrVpdTable-1/-2 uint32 wrap

Twin of DF-4622 (ar5413) / DF-4650 (ar2316) / DF-4662 (ar2413), verified for sys/dev/netif/ath/ath_hal/ar5212/ar2317.c.

Build

Same harness as DF-4680: cd /root/df2317 && sh build.sh

Run

./ar2317_harness 3

Expected (baseline)

REPRODUCED: SIGSEGV si_addr=0xa00475dfe
  expected wild READ address 0xa00475dfe (uint32 index wrap ...)
MATCH: wild OOB read proven (ar2317.c uint32 counter underflow)

A flat EEPROM power curve (all pwr_t4 deltas zero → Pmax_t2 == Pmin_t2) makes sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii] (ar2317.c:438, uint32 arithmetic) zero; the Vpd_step computation at :445-446 then reads VpdTable_I[ii][sizeCurrVpdTable-1] and [sizeCurrVpdTable-2] — element indices 0xFFFFFFFF / 0xFFFFFFFE → wild reads at row + 0x1FFFFFFFE (+8.59 GB). Left unmapped in userspace, the harness faults at exactly the predicted address. No malformed EEPROM is even required — degenerate flat cal curves suffice. (:427 also reads VpdTable_I[ii][1], left uninitialized in this shape — side observation.)

Fix validation

fix.diff guards the [-1]/[-2] reads with sizeCurrVpdTable >= 2 (Vpd_step=1 fallback) and clamps the extrapolate-above last index. Patched mode 3 (fix_run.log): completes with sane minPower=0x003e, no SIGSEGV.

Not re-reported: DF-1806 (numChannels==0), DF-4681 (zero-gain) — different triggers, different guards.

DF-4682 — VERDICT

Status: REPRODUCED (guest, verbatim-extraction harness, mode 3) · impact: dos · confidence: certain · fix: fixed (validated)

Root cause

sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii]; (ar2317.c:438) is uint32_t arithmetic over int16_t values. An EEPROM curve whose pwr_t4 points are all equal (flat calibration — two identical pier powers, delta fields 0) yields Pmax_t2 == Pmin_t2, so sizeCurrVpdTable == 0, and:

Vpd_step = (uint16_t)(VpdTable_I[ii][sizeCurrVpdTable-1] -   /* [0xFFFFFFFF] */
               VpdTable_I[ii][sizeCurrVpdTable-2]);    /* [0xFFFFFFFE] */

(ar2317.c:445-446) — wild reads at row + 0x1FFFFFFFE bytes. The same wrap pattern repeats in the extrapolate-above block (:455). Additionally :427 reads VpdTable_I[ii][1], which ar2317FillVpdTable left uninitialized when the span is 0 (its while (ii <= 0) writes only index 0).

Verification (run.log mode 3)

Four gains, numVpd=4, pwr_t4 all 124 → Pmin=Pmax=62, sizeCurrVpdTable=0. The harness leaves the wild target unmapped: SIGSEGV with si_addr == &vpdTable_I[0][0] + 0x1FFFFFFFE exactly (asserted in the handler; run.log shows the MATCH line). In-kernel the same address hits the direct map (garbage Vpd_step → extrapolated pdadc values → pcdacTable → 32 PHY writes, :566-573) or a KVA hole (panic).

Flat curves are the mildest trigger of the three ar2317 siblings — no malformed EEPROM needed, just equal calibrated power points.

Fix validation (fix_run.log, fixC section)

fix.diff: if (sizeCurrVpdTable >= 2) { ...existing Vpd_step math... } else Vpd_step = 1; plus vpdLastIdx = (sizeCurrVpdTable >= 1) ? sizeCurrVpdTable-1 : 0 for the extrapolate-above reference. Patched mode 3 completes with minPower=0x003e (= 62, the flat curve's Pmin — sane) and no fault. git apply --check clean; never applied to sys/.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.