DF-4722 — PoC evidence pack

Finding: ath_tdma_update passes the 0xff sentinel from rateCodeToIndex[] into ath_hal_pkt_txtime → OOB read rates->info[255] (64-entry table), possible divide-by-zero panic.

Contents

• VERDICT.md — full path:line mechanism (sentinel init, table size, HAL unguarded index, panic sub-path, trigger preconditions).
• verdict.json — machine verdict (status: untested; hw-gated).
• fix.diff — validate rix in the driver before the HAL call.

Reproduce / Expected

Needs an Atheros NIC in an admin-configured TDMA BSS receiving a beacon whose hw rate code is absent from the current rate table (dynamic-turbo / mode switch corners). Not reproducible on the QEMU guest (no radio).

DF-4722 — ath_tdma_update feeds the 0xff sentinel from rateCodeToIndex[] into HAL duration math — OOB read of rates->info[255] (table has 64 entries)

File: sys/dev/netif/ath/ath/if_ath_tdma.c · Severity: Low · Bucket: memcorrupt (OOB read) · Confidence: likely

Root cause (path:line)

ath_tdma_update() is the ic_tdma_update callback (if_ath.c:1030), invoked by the net80211 layer while processing a received TDMA beacon (wlan/ieee80211_tdma.c:506 → tdma_process_params → tdma_update → ic_tdma_update, only in IEEE80211_S_RUN, i.e. attacker-adjacent remote input once an admin has configured a TDMA BSS):

rs = sc->sc_lastrs;                                 /* if_ath_tdma.c:397 */
...
rix = rt->rateCodeToIndex[rs->rs_rate];             /* if_ath_tdma.c:407 */
...
txtime = ath_hal_pkt_txtime(ah, rt, rs->rs_datalen,
    rix,                                            /* if_ath_tdma.c:432-436 */
    !!(rs->rs_flags & HAL_RX_2040),
    (rix & 0x80) ? (!(rs->rs_flags & HAL_RX_GI))
                 : rt->info[rix].shortPreamble);

rateCodeToIndex[256] is built by ath_hal_setupratetable() (ath_hal/ah.c:568-584) with 0xff as the sentinel for every rate code absent from the table. rs->rs_rate is the raw hardware rate code of the received frame (ar5212_recv.c:276, ar5416_recv.c:200), which the HAL comment itself says can be invalid "during dynamic Turbo transitions" (ah.c:366-367 — same lookup family), and is not guaranteed to be present in the current sc_currates table (mode/channel switch races, mixed-rate frames from IBSS merges).

With rix == 0xff:

1. ath_hal_pkt_txtime() (ah.c:286-305) does rc = rates->info[rateix].rateCode unconditionally (ah.c:291) → OOB read at info[255] — HAL_RATE_TABLE.info[] has 64 entries (ah.h:681) — i.e. reads at byte offset 255sizeof(entry) (~3.0 KB) from info[0], ~2.3 KB beyond the end* of the array, pulling adjacent kernel data (static/heap rate tables or neighboring allocations).
2. ath_hal_computetxtime() (ah.c:351-...) then reads info[0xff].rateCode/.rateKbps/.phy/.shortPreamble again (4+ more OOB reads). If the garbage kbps is in [1,124] and garbage phy matches an OFDM case, bitsPerSymbol == 0 and — with HALASSERT compiled out — numSymbols = howmany(numBits, bitsPerSymbol) is a divide-by-zero panic; on INVARIANTS/debug builds the KASSERT(numStreams > 0 && <= 4) at ah.c:301-303 fires instead.
3. Otherwise the garbage txtime propagates into nextslot = (rstamp - txtime) + ... (if_ath_tdma.c:438) — with txtime > rstamp the u64 underflows and the subsequent ath_tdma_settimers() programs garbage beacon timers.

Note the driver's own ternary at :435-436 only accidentally avoids rt->info[0xff] (0xff & 0x80 is true → GI branch); the HAL call is unguarded.

Impact

Remote-adjacent (peer in the admin-configured TDMA BSS) kernel OOB read (~2.3 KB past a rate table) whose value drives timer arithmetic; possible division-by-zero panic depending on adjacent-data layout; INVARIANTS builds can KASSERT. No direct disclosure to userspace. Preconditions are narrow (TDMA mode requires admin setup + HAL macversion > 0x78, if_ath.c:1028; needs a rate-table/code mismatch such as dynamic turbo or mode-switch race — hence Low/likely, consistent with DF-1518's treatment of the analogous ar5416ChainTxDesc unvalidated-index OOB).

Verification

No Atheros NIC in the QEMU guest (and TDMA requires admin configuration on real radio hardware) — static trace only. Mechanism fully pinned: sentinel init ah.c:573-574, table size ah.h:681, unguarded index ah.c:291.

Recommended fix

Validate the lookup before use in if_ath_tdma.c (and ideally a HAL-side guard in ath_hal_pkt_txtime): bail out of the timer update when rix == 0xff. See fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.