DF-5023
Unsupported 5GHz radio revision check fails open: the HAL_ENOTSUPP/goto bad rejection is compiled out unless AH_DEBUG (FreeBSD-inherited)
Summary
The default-case rejection of unsupported radio revisions sits INSIDE #ifdef AH_DEBUG - production builds attach anyway and drive the unsupported radio with the ar2133 backend. FreeBSD-inherited (verified against freebsd-src main 2026-09); not attacker-controllable (hardware register read). All 11 HAL_INI_INIT counts verified matching, error unwind through ar5416Detach sound, v14 leak is DF-4913. Move-rejection-out-of-guard one-liner fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5023 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 839 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
per-fix-DF-5023
Confirmed kernel references
Detail
Evidence (decisive lines)
source-level analysis in finding markdown
Verified recommended fix
move ENOTSUPP rejection out of #ifdef AH_DEBUG
Verdict
untested (hardware-gated: no AR9160 NIC on audit guest)
No comments yet.