=== DF-0612 harness: ieee80211_parse_tdma OOB setbit ===
sizeof(ieee80211_tdma_state)=72 sizeof(ieee80211_tdma_param)=24
offsets: tdma_inuse@8 tdma_active@9 tdma_count@12 tdma_peer@16 tdma_lastprint@24 tdma_fails@40 tdma_newstate(fnptr)@48
tdma_inuse is a 1-byte array; setbit(ts->tdma_inuse, slot) writes at
  struct offset 8 + slot/8. slot>=8 is OOB. Max slot=255 -> offset 39.
Function pointers (tdma_newstate etc.) start @48 -> NOT reachable (u8 idx).

[Case 1] slot=64 -> setbit writes tdma_peer byte 0 (offset 16)
    [before] tdma_inuse[0]=0x00 tdma_active[0]=0x00 tdma_count=0x41414141 tdma_peer=0xdeadbeefcafebabe tdma_lastprint(tv_sec)=1111638594
    [UNFIXED] tdma_inuse[0]=0x00 tdma_active[0]=0x00 tdma_count=0x41414141 tdma_peer=0xdeadbeefcafebabf tdma_lastprint(tv_sec)=1111638594
    -> tdma_peer changed 0xdeadbeefcafebabe -> 0xdeadbeefcafebabf : OOB WRITE CONFIRMED

[Case 2] slot=255 -> setbit writes last byte of tdma_lastprint (offset 39)
    [before] tdma_inuse[0]=0x00 tdma_active[0]=0x00 tdma_count=0x00000000 tdma_peer=0x0 tdma_lastprint(tv_sec)=0
    [UNFIXED] tdma_inuse[0]=0x00 tdma_active[0]=0x00 tdma_count=0x00000000 tdma_peer=0x0 tdma_lastprint(tv_sec)=0
    -> byte at struct offset 39 (= &tdma_inuse[31]) flipped: OOB WRITE CONFIRMED

[Case 3] slot=8 -> setbit writes tdma_active[0] (offset 9, 1 past array)
    [before] tdma_inuse[0]=0x00 tdma_active[0]=0x00 tdma_count=0x00000000 tdma_peer=0x0 tdma_lastprint(tv_sec)=0
    [UNFIXED] tdma_inuse[0]=0x00 tdma_active[0]=0x01 tdma_count=0x00000000 tdma_peer=0x0 tdma_lastprint(tv_sec)=0
    -> tdma_active[0] = 0x01 : OOB WRITE CONFIRMED

[Case 4] short IE (len=6) -> tdma_slot read from beyond IE body
    istdmaoui only requires ie[1]>3, so a len=6 IE passes OUI check but
    tdma_slot@ie[8] is read from whatever follows in the ies->data blob.
    declared IE len=6, but parser reads tdma_slot=0xab (offset 8)
    -> OOB READ from short IE; value drives the setbit index.

[Case 5] FIXED parse_tdma rejects OOB slots and short IE
    [FIXED] rejected: tdma_slot=64 >= TDMA_MAXSLOTS=2
    [after slot=64] tdma_inuse[0]=0x00 tdma_active[0]=0x00 tdma_count=0x00000000 tdma_peer=0xdeadbeefcafebabe tdma_lastprint(tv_sec)=0
    -> tdma_peer UNCHANGED (0xdeadbeefcafebabe == 0xdeadbeefcafebabe): FIX HOLDS

[Case 6] FIXED parse_tdma accepts valid slot=1 (in range [0,TDMA_MAXSLOTS))
    [FIXED] accepted: setbit in-bounds (slot=1)
    [after slot=1] tdma_inuse[0]=0x02 tdma_active[0]=0x00 tdma_count=0x00000000 tdma_peer=0x0 tdma_lastprint(tv_sec)=0
    -> tdma_inuse[0]=0x02 (bit 1 set in-bounds): legit path preserved

=== harness complete: OOB write confirmed on UNFIXED, blocked on FIXED ===