=== DF-0713 cac_timeout NULL-deref trigger ===

[*] Checking for wlan interfaces...
[-] No wlan interfaces present.
[*] Attempting to create one...
[-] Cannot create wlan vap: no parent wireless device (wlandev) available.
[-] This VM has no DFS-capable 802.11 radio hardware.

[*] Network interfaces on this host:
vtnet0 lo0

[*] Looking for net.wlan.*.radar sysctls (per-vap DFS trigger)...
[-] No net.wlan.N.radar sysctl found.
[-] The 'radar' sysctl is only created when a vap with
    IEEE80211_C_DFS capability exists (ieee80211_dragonfly.c:477-480).
[-] Without a DFS-capable wireless NIC, the vulnerable path
    (cac_timeout → iv_des_chan=NULL → hostap SCAN deref) is unreachable.

=== RESULT: cannot trigger on this guest (no wireless hardware) ===
=== Bug confirmed real by source-level trace — see VERDICT.md ===
EXIT=2