==> building BUG-PRESENT harness (no cap, no clamp)
==> building FIXED harness (cap + clamp, mirrors fix.diff)
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx   9984 Jul 16 10:04 harness
-rwxr-xr-x  1 maxx  maxx  10088 Jul 16 10:04 harness_fixed
=== FIXED harness on patched #1 kernel ===
=== DF-0350 harness: unbounded mesh route-table growth + attacker-controlled lifetime ===
build mode                     : FIXED (cap+clamp applied)
preq->preq_lifetime (attacker) : 0xFFFFFFFF msec (49.7 days)
attack: distinct originators   : 8000 PREQ frames
sizeof(struct ieee80211_mesh_route) + HWMP priv = 88 + 12 = 100 bytes/entry

---- Result of the flood ----
routes successfully added      : 4096
routes rejected (NULL)         : 3904
final ms_routes table size     : 4096 entries
kernel memory pinned by table  : 409600 bytes (0.4 MiB)  [per-vap]

---- Lifetime claim (attacker-controlled dwell) ----
first added route rt_lifetime  : 0x0000EA60 msec (0.0 days)
  (rt_lifetime == preq->preq_lifetime, UNVALIDATED: claim #2 refuted)

---- DoS ceiling extrapolation ----
distinct MACs available (0x02xx) : ~2^46 = 70368744177664
entries to exhaust a 256 GB kmem : ~2748779069 (262143 MiB)
=> attacker can pin memory until kmem exhaustion / kernel panic.

VERDICT: FIXED — table capped at 4096 entries (rejected 3904 over-cap PREQs); lifetime clamped to 60000 msec (60 s, was 49.7 days)