# DF-0275 — Heap buffer overflow in WPA/RSN IE construction

## Claim
`add_ie()` (`ieee80211_output.c:1976`) does `memcpy(frm, ie, 2+ie[1])` trusting
`ie[1]` unconditionally. Frame allocators reserve a fixed
`sizeof(struct ieee80211_ie_wpa)=100`-byte slot, but the `IEEE80211_APPIE_WPA`
ioctl permits `ie[1]` up to 1022 (`IEEE80211_MAX_APPIE=1024`). An IE with
`ie[1] > 98` overflows the mbuf data area by up to ~924 attacker-controlled bytes.

## Runtime status on this guest
**NOT runtime-testable** — the guest has no 802.11 radio hardware and cannot
create an `ieee80211vap`, so neither the privileged IE-install ioctl nor the
management-frame TX path can be exercised. The bug is **definitively confirmed
by source trace** (see `VERDICT.md`): `sizeof(struct ieee80211_ie_wpa)=100`,
`ie[1]` can reach 1022, `add_ie` writes `2+ie[1]` bytes.

## Reproduce (requires WiFi hardware / a vap)
On a system with a WiFi interface in hostap/ibss/sta mode (root to set the IE):
1. Create/bring up a vap.
2. `ifconfig wlan0 -wpa` / set the WPA app-IE via `IEEE80211_APPIE_WPA` with an
   IE whose length byte > 98 (up to 1022).
3. Trigger a management-frame TX that includes the WPA/RSN IE (e.g. a probe
   response to an incoming probe request). → heap overflow / panic on GENERIC.

There is no runnable PoC in this folder because the defect cannot be exercised
without WiFi hardware; the authoritative evidence is the source trace in
`VERDICT.md` and the fix in `fix.diff`.

## Build / Run
N/A on this guest (no WiFi HW). `fix.diff` applies + compiles cleanly
(nativekernel).

## Fix
`fix.diff` caps `ie[1]` in `setwparsnie()` to `sizeof(struct ieee80211_ie_wpa)-2`
so a stored IE always fits the fixed frame-constructor slots.