# DF-0322 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ieee80211_ampdu_rx_start_ext has the author's own XXX TODO to sanity-check tid/seq/baw; tid indexes ni_rx_ampdu[tid] with no [0,16) bound and baw is int -- a negative baw -> min(neg,64)=neg -> uint16 rxa_wnd -> huge -> rxa_m[off] heap OOB write. Driver-gated.

## Impact ceiling
none

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_ht.c:570

## Fix
Validate tid in [0, WME_NUM_TID) and clamp baw>=0 before use.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.