DF-4799

ar9285: 2GHz-only Kite never enforced — 11A/11NA caps advertised (GMODE divergence), 5GHz channel edges inherited, nf_5g limits left zeroed: 5GHz channels selectable → radio programmed out of calibrated design with 2GHz-only data

Summary

ar9285FillCapabilityInfo inherits the GMODE->11A caps divergence and unconditional 5GHz edges without a 2GHz clamp, and nf_5g is never initialized - an EEPROM 11A bit exposes 5GHz channels on 2GHz-only silicon; tuning one programs RF2G-only banks from 2GHz piers and clamps NF to 0. No crash (unlike twin DF-4793 - ar9285 assigns its pier list unconditionally): regulatory misoperation/dead radio only. Clamp-caps+edges fix also fixes the shared GMODE block.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: likely
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE: CWE-665
File: sys/dev/netif/ath/ath_hal/ar9002/ar9285_attach.c
Lines: 527-535
Area: dev
Discovered: 2026-09-23
Updated: 2026-09-23

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: none
Confidence: likely
Tested: 2026-09-23 23:30:09
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: likely
Tested: 2026-09-23 23:30:09
Runtime: —
Kernel: per-fix-DF-4799
fix.diff: findings/poc/DF-4799/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4799 · 1 files

File	Type	Description	Size
verdict.json	file		1.5 KB	view raw

Fix verification

not_testable

per-fix-DF-4799

Confirmed kernel references

Detail

Exploit chain

EEPROM 11A bit -> 5GHz channels in ic_channels -> channel 36 tunes 2GHz-only banks from 2GHz piers -> out-of-band uncalibrated radio, NF clamped to 0 (no panic)

Evidence (decisive lines)

findings/poc/DF-4799/ (this verdict; full static chain in reviewer notes)

Verdict

Hardware-bound caps/regulatory defect, no memory corruption: ar9285FillCapabilityInfo inherits the ar5416 GMODE->11A/11NA caps divergence (ar5416_attach.c:904-914) and unconditional 4915-6100 edges, never clamps to 2GHz, and nf_5g limits are left zeroed ('XXX no 5ghz values?') - a card whose EEPROM opCapFlags carries the 11A bit (untrusted-EEPROM model, same as DF-4548/4624/4793) exposes 5GHz channels on 2GHz-only silicon; tuning one programs RF2G-only analog banks from 2GHz cal piers and sanitizes every 5GHz NF read against {0,0,0}. Unlike the ar9287 twin DF-4793 there is NO crash: ar9285SetPowerCalTable assigns its pier list unconditionally, so impact is regulatory misoperation/dead radio. Static chain verified line-by-line; no AR9285 on the guest. Clamp-caps+edges fix (+init nf_5g, and fix the shared GMODE block for both twins).