# DF-0365 PoC — ieee80211_media_setup unbounded rate-set merge

**Status:** LATENT — code-level overflow confirmed, NOT reachable on audit guest.
**Severity:** Medium

## Bug
`sys/netproto/802_11/wlan/ieee80211.c:1564` declares
`struct ieee80211_rateset allrates` on the stack. The collection loop
(lines 1565–1594) writes `allrates.rs_rates[j]` and increments
`allrates.rs_nrates` whenever a new unique rate is seen — with **no
check** that `rs_nrates < IEEE80211_RATE_MAXSIZE` (= 15). A NIC
advertising 11a + 11b + 11g + HALF + QUARTER modes produces 17
distinct rate values, overflowing `rs_rates[15]` and `rs_rates[16]`.

## Why not testable here
Same as DF-0352: no WiFi HW. `ieee80211_media_setup` runs only at
vap-attach, which requires a real WiFi driver.

## Files
- `fix.diff`     — bounds-check before write
- `VERDICT.md`   — full narrative
- `env.txt`