# DF-0288 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: mesh_parse_meshpeering_action decodes peer_linkid/peer_rcode (offset 6-7) before verifying peer_len>=base; a peer_len==4 IE yields a 2-byte OOB read. Remote (mesh).

## Impact ceiling
none

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_mesh.c:2183

## Fix
Guard: if peer_len < IEEE80211_MPM_BASE_SZ, return NULL before decoding.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.