DF-4688 -- verdict narrative

What was claimed

numPdGainsUsed==0 (EEPROM xpd_mask==0): uint32-wrapped wild reads at array+0x1FFFFFFFE (+8.59 GB) in the backfill loops + stale-static Pmin_t2[0] read (twin of DF-4620/4649/4661/4681)

Reproduced?

YES (mode 2 of the shared verbatim-extraction harness, run on the DragonFly guest).

REPRODUCED on the DragonFly guest (verbatim-extraction harness, mode 2): with an EEPROM-shaped zero-gain dataset (xpd_mask=0 -> all numVpd==0, the exact shape ar2413SetupRawDataset produces) the backfill loops index with uint32 counters at 0: pPdGainBoundaries[ii-1] (ar2425.c:485) and pPDADCValues[kk-1] (:489) wrap to element index 0xFFFFFFFF and read at array+0x1FFFFFFFE bytes (+8.59 GB) -- proven by mapping the exact wild pages (kernel direct-map emulation), seeding 0x5A5A and observing both values propagate into gainBoundaries[0] (-> AR_PHY_TPCRG5 via ar2425SetPowerTable:557-562) and pcdacTable[0] (-> 32 PHY reg writes, ar2425.c:548-555). ar2425-specific nuance vs the family twins: Pmin_t2/Pmax_t2 are FUNCTION-SCOPE STATICS (:377-379), so *pMinCalPower = Pmin_t2[0] at :431 is a STALE-STATIC read (residue of the previous channel's calibration; harness 0xAAAA prefill propagates deterministically), not an uninitialized-stack read. In-kernel the +8.6GB read is a wild KVA read -> panic (KVA hole) or garbage radio programming; HALASSERT is compiled out in release. Exploitation gated on crafted-EEPROM AR2425 hardware (physical/supply-chain); ceiling is DoS/radio misprogramming. Twin of DF-4620 (ar5413) / DF-4649 (ar2316) / DF-4661 (ar2413) / DF-4681 (ar2317). Fix validated (early return + caller xpd_mask check): no wild reads, minPower sentinel untouched.

Fix validation

Harness-level validation (fix_validate.sh): baseline mode 2 shows 0x5A5A from both wild pages propagating into gainBoundaries[0]/pcdacTable[0] and minPower=0xAAAA (stale static); with fixB the function returns before any backfill (gb[0]=0, pcdacTable[0]=canary 0xAAAA, minPower=sentinel 0x7c7c untouched). No kernel rebuild: no AR2425 hardware on the guest; validated against verbatim-extracted bodies per family methodology.

Decisive evidence: run.log: 'gainBoundaries[0] = 0x5a5a ... pcdacTable[0] = 0x5a5a ... minPower out = 0xaaaa'; fix_run.log: 'PATCHED mode 2 ... minPower=0x7c7c ... exit=1'.

Why no in-kernel run

The guest has no AR2425 NIC and no EEPROM-injection path; the family methodology (DF-4619..DF-4683, all accepted with the same constraint) compiles the real function bodies against faithful struct/static layouts and proves the violation with exact-address faults / canaries / propagation -- equivalent strength for a hardware-gated defect, and it validates the fix the same way.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.