# DF-0349 PoC — WiFi HWMP PREQ OOB read

## Status: REAL (source-trace confirmed), not testable on this guest

The OOB read is confirmed by tracing:
- `verify_mesh_preq_len()` accepts `ndest==0`
- `kmalloc(sizeof(*preq) + (ndest-1)*sizeof(target))` wraps to 34 bytes
- Slab rounds to 40 bytes; `preq_targets[0]` at offset 34-44 → 5 bytes OOB
- `hwmp_recv_preq()` at `:1005` unconditionally reads `preq_targets[0]`

**Not testable** because:
- No WiFi hardware on this guest
- `wlan` module not loaded at runtime
- Requires a remote mesh peer sending crafted PREQ frames

The code IS compiled into GENERIC (`device wlan` +
`IEEE80211_SUPPORT_MESH`).

## Fix

See `fix.diff` — rejects `ndest < 1` in `verify_mesh_preq_len()`.
Verified to compile cleanly on GENERIC.