# DF-0352 PoC — RANN overwrites shared ieee80211_hwmp_rannint (no lock)

**Status:** LATENT — code-level bug confirmed, NOT reachable on audit guest.
**Severity:** Medium (downgraded from "DoS" because guest lacks WiFi HW)

## Bug
`sys/netproto/802_11/wlan/ieee80211_hwmp.c:1971` writes the on-wire
`rann->rann_interval` directly into the file-scope global
`ieee80211_hwmp_rannint` (used by every vap's RANN callout) with **no
lock** (the comment even says `XXX: mtx lock?`). A remote on-link
attacker can forge a RANN with `rann_interval=0` to pin the callout
at hard-clock frequency (CPU-saturation DoS), and the unlocked store
races sysctl reads of the same global.

## Why not testable here
The audit guest has **no WiFi hardware** and no `wlan`/mesh module
loaded. `hwmp_recv_rann` is dead code at runtime on this guest; an
unprivileged user cannot create a vap, and `kldload` is root-only.
This is the "genuinely not reachable on this kernel" category with a
real latent bug — see `VERDICT.md` for the full source trace.

## Files
- `fix.diff`     — atomic write + sanity lower-bound
- `VERDICT.md`   — full narrative
- `env.txt`      — guest environment