From 6aa8a2f892093682abcc0b95a25484d91adaa79f Mon Sep 17 00:00:00 2001
From: achazal <achazal@quarkslab.com>
Date: Tue, 2 Jun 2026 19:02:05 +0200
Subject: [PATCH] Fix MAD1 off-by-one in MADDecode: loop read Key A as 16th AID

---
 client/src/mifare/mad.c | 3 +--
 client/src/mifare/mad.h | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/client/src/mifare/mad.c b/client/src/mifare/mad.c
index 27eb6f4d3..a38a004fa 100644
--- a/client/src/mifare/mad.c
+++ b/client/src/mifare/mad.c
@@ -262,8 +262,7 @@ int MADDecode(uint8_t *sector0, uint8_t *sector16, uint16_t *mad, size_t *madlen
         PrintAndLogEx(INFO, "overriding crc check");
     }
 
-    // 7 + 8 == 15
-    for (int i = 1; i <= 16; i++) {
+    for (int i = 1; i < 16; i++) {
         mad[*madlen] = madGetAID(sector0, swapmad, 1, i);
         (*madlen)++;
     }
diff --git a/client/src/mifare/mad.h b/client/src/mifare/mad.h
index e3b039044..d6da702cd 100644
--- a/client/src/mifare/mad.h
+++ b/client/src/mifare/mad.h
@@ -21,8 +21,8 @@
 
 #include "common.h"
 
-// 16 MAD1 AIDs + 1 MAD2 marker (0x0005) + 23 MAD2 AIDs = 40
-#define MAD_MAX_AID_ENTRIES 40
+// 15 MAD1 AIDs (sectors 1-15) + 1 MAD2 marker (0x0005) + 23 MAD2 AIDs (sectors 17-39) = 39
+#define MAD_MAX_AID_ENTRIES 39
 
 int MADCheck(uint8_t *sector0, uint8_t *sector16, bool verbose, bool *haveMAD2);
 int MADDecode(uint8_t *sector0, uint8_t *sector16, uint16_t *mad, size_t *madlen, bool swapmad, bool override);