# DF-0640 VERDICT

## Verdict: REPRODUCED

## Mechanism
Source: `sys/netproto/802_11/wlan/ieee80211_crypto.c:587-590,598,613,624-625`

ieee80211_crypto_decap minlen ignores hdrlen.

WiFi hardware is unavailable on QEMU guest. Source trace confirms both impacts: (1) OOB read at m_copydata(m, hdrlen+3) for 4-addr frames with hdrlen=32 and len in [32,35]; (2) double-free when m_pullup fails (frees mbuf, returns NULL, caller m_freem(m) → double-free). The buggy MINLEN hardcodes sizeof(ieee80211_frame)=24 instead of using caller-supplied hdrlen. Harness demonstrates both paths.

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.