DF-0393 / fix_run.log
============================================================
DF-0393 FIX VALIDATION — single-fix kernel #1 (Thu Jul 16 02:19:43 UTC 2026)
fix.diff applied to /usr/src, kernel rebuilt (rc=0), installed as /boot/kernel/kernel
(sha256 26f47b98b14fe33c618f10ee1dd0e7a6954977449a2be589c88d9cea4bc5c9d1),
booted as #1.
============================================================
[1] PATCHED snippet (harness_fixed.c, verbatim clamped sta_add:310-322):
meshid[1]=200 -> clamped 32, copy 34 bytes, se_ies/se_age/canary INTACT
------------------------------------------------------------
[meshid=200]
--- meshid[1]=200 ---
=== DF-0393 harness: Mesh ID heap overflow in sta_add() ===
struct ieee80211_scan_entry size : 504 bytes
offsetof(se_meshid) : 348
offsetof(se_ies) : 384 (overflow lands here)
offsetof(se_age) : 496
sizeof(se_ies) : 112
se_meshid field width : 34 bytes (2+IEEE80211_MESHID_LEN, LEN=32)
Attacker Mesh ID IE length byte : 200 (sp->meshid[1])
memcpy copy size (2+meshid[1]) : 202 bytes
Overflow past se_meshid[34] : 168 bytes
[*] Invoking verbatim sta_add():312 memcpy...
[*] memcpy returned (no trap in userspace — the OOB write is silent).
---- Corruption report (PATCHED harness) ----
input meshid[1] = 200
clamped meshidlen = 32 (IEEE80211_MESHID_LEN=32)
actual memcpy size = 34 bytes (<= se_meshid width 34)
se_meshid[34] (full field) (34 bytes):
71c84d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
4d4d
se_ies.wpa_ie ptr = 0xaaaaaaaaaaaaaaaa (intact)
se_age = 0xAABBCCDD (intact)
canary = intact
VERDICT: NO OVERFLOW — fix in effect: meshid[1]=200 clamped to 32, actual copy 34 bytes fits se_meshid[34]; se_ies/se_age/canary all intact.
[meshid=255 (max ceiling)]
=== DF-0393 harness: Mesh ID heap overflow in sta_add() ===
struct ieee80211_scan_entry size : 504 bytes
offsetof(se_meshid) : 348
offsetof(se_ies) : 384 (overflow lands here)
offsetof(se_age) : 496
sizeof(se_ies) : 112
se_meshid field width : 34 bytes (2+IEEE80211_MESHID_LEN, LEN=32)
Attacker Mesh ID IE length byte : 255 (sp->meshid[1])
memcpy copy size (2+meshid[1]) : 257 bytes
Overflow past se_meshid[34] : 223 bytes
[*] Invoking verbatim sta_add():312 memcpy...
[*] memcpy returned (no trap in userspace — the OOB write is silent).
---- Corruption report (PATCHED harness) ----
input meshid[1] = 255
clamped meshidlen = 32 (IEEE80211_MESHID_LEN=32)
actual memcpy size = 34 bytes (<= se_meshid width 34)
se_meshid[34] (full field) (34 bytes):
71ff4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
4d4d
se_ies.wpa_ie ptr = 0xaaaaaaaaaaaaaaaa (intact)
se_age = 0xAABBCCDD (intact)
canary = intact
VERDICT: NO OVERFLOW — fix in effect: meshid[1]=255 clamped to 32, actual copy 34 bytes fits se_meshid[34]; se_ies/se_age/canary all intact.
------------------------------------------------------------
[2] CONTROL: unfixed snippet (harness.c) STILL overflows on the same #1 guest
(proves the harness is sound; only the clamp differs)
------------------------------------------------------------
offsetof(se_age) : 496
memcpy copy size (2+meshid[1]) : 257 bytes
Overflow past se_meshid[34] : 223 bytes
OVERFLOW detected: 223 bytes wrote past end of se_meshid[34]
se_ies.wpa_ie ptr = 0x4242414141414141 (was 0xAAAAAAAAAAAAAAAA)
se_age = 0x41414141 (was 0xAABBCCDD)
CANARY CORRUPTED at tail offset +0 (se_age+16+0 region)
=> OOB write reached 1 bytes beyond se_age (into adjacent heap)
VERDICT: OOB WRITE CONFIRMED — 223 bytes past se_meshid[34] (112 into se_ies, rest into se_age/canary)
============================================================
FIX VERDICT: patched snippet clamps meshid[1] to 32 for ALL inputs (200,255);
actual copy = 34 bytes = exactly se_meshid[34]; NO overflow into se_ies/se_age.
Unfixed snippet still overflows (223 bytes @ meshid[1]=255). Fix closes the path.
============================================================