# DF-0327 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ieee80211_ies_expand advances ie+=2+ie[1] without checking ie[1] vs remaining ielen; a non-TLV-aligned blob reads past ies->data. Mitigated: parse_beacon pre-validates. Latent defense-in-depth.

## Impact ceiling
none

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_node.c:983

## Fix
Require ielen>=2 and ie[1]+2<=ielen before advancing through the IE blob.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.