=== DF-0712: ieee80211_alloc_countryie 3-byte heap overflow ===
IEEE80211_COUNTRY_MAX_SIZE = 257
sizeof(struct ieee80211_appie) = 2 (ie_len header)
Feeding 84 channels -> 84 runs (== IEEE80211_COUNTRY_MAX_BANDS cap)

alloc size (kernel kmalloc arg) = 257 bytes
ie_data bytes available        = 255
ie_data valid indices          = 0..254
nruns=84  ie->len=0  aie->ie_len=258
highest ie_data index written   = 257
  OOB+1: alloc[257] = 0x01 (was 0xcd)
  OOB+2: alloc[258] = 0xf3 (was 0xcd)
  OOB+3: alloc[259] = 0x00 (was 0xcd)

RESULT: 3-byte heap OOB write detected past the 257-byte allocation.
  OOB+1 (alloc[257]) = number-of-channels byte = 1 (constant)
  OOB+2 (alloc[258]) = ic_maxregpower = ATTACKER-CONTROLLED byte
  OOB+3 (alloc[259]) = 0x00 (odd-length IE pad byte)
BUG CONFIRMED: kmalloc(IEEE80211_COUNTRY_MAX_SIZE)=257 but the IE
  assembly writes up to alloc[259] (needs 260 bytes total).
RUN_EXIT=0