# DF-0294 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: get_scan_result KASSERT(len<=65535 && ielen<=65535) on remote-sourced beacon IE lengths -> INVARIANTS panic (remote DoS); on release uint16 truncation yields malformed scan records.

## Impact ceiling
panic

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_ioctl.c:280

## Fix
Replace the KASSERT with a clamp (cap len/ielen to 65535) so remote input cannot panic.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.