############ BUG PRESENT (unpatched logic) ############
=== DF-0350 harness: unbounded mesh route-table growth + attacker-controlled lifetime ===
build mode                     : BUG PRESENT (no cap, no clamp)
preq->preq_lifetime (attacker) : 0xFFFFFFFF msec (49.7 days)
attack: distinct originators   : 8000 PREQ frames
sizeof(struct ieee80211_mesh_route) + HWMP priv = 88 + 12 = 100 bytes/entry

---- Result of the flood ----
routes successfully added      : 8000
routes rejected (NULL)         : 0
final ms_routes table size     : 8000 entries
kernel memory pinned by table  : 800000 bytes (0.8 MiB)  [per-vap]

---- Lifetime claim (attacker-controlled dwell) ----
first added route rt_lifetime  : 0xFFFFFFFF msec (49.7 days)
  (rt_lifetime == preq->preq_lifetime, UNVALIDATED: claim #2 CONFIRMED)

---- DoS ceiling extrapolation ----
distinct MACs available (0x02xx) : ~2^46 = 70368744177664
entries to exhaust a 256 GB kmem : ~2748779069 (262143 MiB)
=> attacker can pin memory until kmem exhaustion / kernel panic.

VERDICT: UNBOUNDED GROWTH CONFIRMED — all 8000 PREQs added a new entry; no cap, no NULL, lifetime = attacker uint32.

############ FIXED (cap + clamp applied) ############
=== DF-0350 harness: unbounded mesh route-table growth + attacker-controlled lifetime ===
build mode                     : FIXED (cap+clamp applied)
preq->preq_lifetime (attacker) : 0xFFFFFFFF msec (49.7 days)
attack: distinct originators   : 8000 PREQ frames
sizeof(struct ieee80211_mesh_route) + HWMP priv = 88 + 12 = 100 bytes/entry

---- Result of the flood ----
routes successfully added      : 4096
routes rejected (NULL)         : 3904
final ms_routes table size     : 4096 entries
kernel memory pinned by table  : 409600 bytes (0.4 MiB)  [per-vap]

---- Lifetime claim (attacker-controlled dwell) ----
first added route rt_lifetime  : 0x0000EA60 msec (0.0 days)
  (rt_lifetime == preq->preq_lifetime, UNVALIDATED: claim #2 refuted)

---- DoS ceiling extrapolation ----
distinct MACs available (0x02xx) : ~2^46 = 70368744177664
entries to exhaust a 256 GB kmem : ~2748779069 (262143 MiB)
=> attacker can pin memory until kmem exhaustion / kernel panic.

VERDICT: FIXED — table capped at 4096 entries (rejected 3904 over-cap PREQs); lifetime clamped to 60000 msec (60 s, was 49.7 days)

RUN_EXIT=0