# DF-0292 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: SIOCG80211 has no caps_priv_check unlike SIOCS80211 (line 3472); any unpriv user reads IOC_SCAN_RESULTS/IOC_STA_INFO (peer MACs/RSSI)/IOC_WPAIE/IOC_BSSID. Privacy concern on hostap vap.

## Impact ceiling
leak

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_ioctl.c:3467

## Fix
Add caps_priv_check_self(SYSCAP_NONET_WIFI) to SIOCG80211 (key material stays separately gated).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.