DF-0351 harness: HWMP uint32 metric-accumulation overflow
(replicates ieee80211_hwmp.c arithmetic; no WiFi HW needed)

== Baseline: honest route to originator, rt_metric=5000000, hr_seq=100 ==

-- VULNERABLE kernel, FRESH seq (HWMP_SEQ_GT true -> update forced) --
  [fresh-seq     ] preq_metric=0xffffffff link=50000  => accumulated=49999       (0x0000c34f)  *** ROUTE POISONED: attacker nexthop installed ***
  -> rt_metric=49999 (was 5000000); attacker_nexthop=1

-- VULNERABLE kernel, EQUAL seq (wrapped metric < stored metric) --
  [equal-seq     ] preq_metric=0xffffffff link=50000  => accumulated=49999       (0x0000c34f)  *** ROUTE POISONED: attacker nexthop installed ***
  -> rt_metric=49999 (legit was 5000000); attacker_nexthop=1

-- VULNERABLE kernel, PREQ forward accumulation (:1325) --
  attacker seeds fwd_metric=0xfffffffe
  hop1: 0xFFFFFFFE + 50000 = 49998 (0x0000c34e)  <-- WRAPS
  hop2: prev + 80000 = 129998  -> propagated to all downstream nodes

-- FIXED kernel (saturating add -> metric clamps to UINT32_MAX) --
  [equal-seq     ] preq_metric=0xffffffff link=50000  => accumulated=4294967295  (0xffffffff)  rejected (legit route preserved)
  -> rt_metric=5000000 (legit PRESERVED); attacker_nexthop=0

VERDICT: vulnerable kernel accepts wrapped near-0 metric and installs the
         attacker as the nexthop (route poisoning / hijack / MITM / blackhole).
         Fixed kernel saturates the sum at UINT32_MAX, so the wrapped tiny
         value never appears and the legitimate route is preserved.