# DF-0328 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: node_getmimoinfo loops i<ni->ni_mimo_chains indexing ni_mimo_rssi_ctl[i]/ni_mimo_noise_ctl[i] (sized IEEE80211_MAX_CHAINS=3) with no clamp; >3 -> OOB read of the node struct + OOB write of the info struct. Driver-gated.

## Impact ceiling
none

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_node.c:1174

## Fix
Clamp ni->ni_mimo_chains to IEEE80211_MAX_CHAINS before the loop.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.