### Patched kernel: kern.version ###
(see env.txt)

### REPRODUCTION HARNESS on patched kernel (underlying wep_decrypt path — UNCHANGED by gate fix) ###
=== DF-0594 TKIP RX length-underflow proof ===
kernel: sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c
cipher: ic_header=8 ic_trailer=4 ic_miclen=8 (u_int)
frame:  m_pkthdr.len=32 (int), hdrlen=24, total=32
WEP floor 32 (ieee80211_crypto.c:598 IEEE80211_WEP_MINLEN)
TKIP need 36 (hdrlen + ic_header + ic_trailer)
build:  INVARIANTS (default X86_64_GENERIC — KASSERT = panic)

[line 994] data_len = m_pkthdr.len - (hdrlen + ic_header + ic_trailer)
         = (int)32 - (u_int)(24 + 8 + 4)
         = (u_int)32 - (u_int)36   [int promoted to u_int]
         = 0x00000000fffffffc  (size_t)  <-- SIGNED/UNSIGNED WRAP (CWE-190)
RESULT: data_len 4294967292 > frame_len 32 => UNDERFLOW CONFIRMED

[INVARIANTS] calling verbatim wep_decrypt; KASSERT(data_len==0) at ieee80211_crypto_tkip.c:698 fires:
panic: out of buffers with data_len 4294967292
cpuid = 0
Trace begins at wep_decrypt+ (DF-0594 KASSERT site)
INV_RC=134

### NO_INVARIANTS reproduction on patched kernel ###
Abort trap (core dumped)
         = (u_int)32 - (u_int)36   [int promoted to u_int]
         = 0x00000000fffffffc  (size_t)  <-- SIGNED/UNSIGNED WRAP (CWE-190)
RESULT: data_len 4294967292 > frame_len 32 => UNDERFLOW CONFIRMED

[NO_INVARIANTS] calling verbatim wep_decrypt with the frame buffer ending at a page boundary (+guard page):
  m_data=0x800473fe0  m_data+m_len=0x800474000  guard page starts at 0x800474000
  [SIGSEGV at 0x800474000 — OOB READ past mbuf data end]
RESULT: SIGSEGV in wep_decrypt ICV check — OOB READ CONFIRMED (CWE-125/CWE-787), page-fault on read past mbuf end.

### FIX-CHECK HARNESS on patched kernel (the actual fix validation) ###
=== DF-0594 fix-validation (patched tkip_decap/tkip_demic guards) ===
decrypt floor = hdrlen + ic_header + ic_trailer = 36
demic   floor = hdrlen + ic_miclen             = 32

[1] 32-byte trigger frame  tkip_decap: REJECTED by guard (fix works)
[2] 35-byte frame           tkip_decap: REJECTED by guard (fix works)
[3] 36-byte frame           tkip_decap: passes (legitimate); line994 data_len=0 (no underflow)
[4] 31-byte frame           tkip_demic: REJECTED by guard (fix works)
[5] 32-byte frame           tkip_demic: passes (legitimate); line357 data_len=0 (no underflow)

RESULT: fix.diff GUARDS the vulnerable path — too-short frames rejected, legitimate frames pass with no underflow. FIX VALIDATED.
FIXCHECK_RC=0