DF-4687 -- verdict narrative

What was claimed

Unbounded kk pdadc walk writes past pcdacTable[PWR_TABLE_SIZE_2413=128] -- intra-object heap OOB write into RF bank scratch (twin of DF-4619/4648/4660/4680)

Reproduced?

YES (mode 1 of the shared verbatim-extraction harness, run on the DragonFly guest).

REPRODUCED on the DragonFly guest by compiling the verbatim kernel function bodies (anchor-extracted ar2425.c:246-494 from /usr/src, md5-verified == audit tree) against a faithful ar2425State layout (bank rows 1/1/1/29/3 from the shipped ar5212.ini; verified offsets pcdac@72 Bank1@328 Bank6@340 Bank7@456, sizeof 472 incl. tail padding): with an EEPROM-shaped crafted dataset (xpd_mask=0xF, Pmin pattern {0,58,58,58}, TPCRG5 overlap 15 -- register-realistic, the field is 4 bits) the unbounded kk walk at ar2425.c:452/:462/:473 wrote uint16 cells past pcdacTable[PWR_TABLE_SIZE_2413=128] into the Bank1Data..Bank7Data members of the ath_hal_malloc'd ar2425State object (intra-object overflow; kk ran to 173, last byte 89 past the array end; RF bank scratch corrupted, reprogrammed to the radio at ar2425.c:200-210). Fully EEPROM-feasible: each pd-gain span of 40-60 half-dB is constructor-legal, four gains sum past 128 by construction. Exploitation is gated on attacker-supplied AR2425/AR2417 hardware with crafted EEPROM (physical/supply-chain); realistic ceiling is radio misprogramming/crash, not privilege escalation. Twin of DF-4619 (ar5413) / DF-4648 (ar2316) / DF-4660 (ar2413) / DF-4680 (ar2317). Fix validated: with kk<PWR_TABLE_SIZE_2413 guards the overflow is gone (bank canary intact).

Fix validation

Harness-level validation (fix_validate.sh): baseline mode 1 clobbers bank cells 0..89 bytes past pcdacTable[127] (kk=173); with fixA (kk < PWR_TABLE_SIZE_2413 in all three loops) mode 1 reports 'NO overflow detected' and the 0xAAAA canary is intact. No kernel rebuild: no AR2425 hardware on the guest; validated against verbatim-extracted bodies per family methodology.

Decisive evidence: run.log: 'DF-4687 REPRODUCED ... first clobbered u16 cell 0 bytes past array end, last 89 bytes past (value 0x007f) => kk ran to 173'; fix_run.log: 'PATCHED mode 1 ... DF-4687: NO overflow detected'.

Why no in-kernel run

The guest has no AR2425 NIC and no EEPROM-injection path; the family methodology (DF-4619..DF-4683, all accepted with the same constraint) compiles the real function bodies against faithful struct/static layouts and proves the violation with exact-address faults / canaries / propagation -- equivalent strength for a hardware-gated defect, and it validates the fix the same way.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.