# DF-0730 — ra_rate_thresh[3][8] heap OOB read/write (latent)

**Severity:** Medium (latent). Real array-size/index mismatch; unreachable in
the default config (no driver selects `wlan_rssadapt`).

## Files
- `df0730_harness.c` — deterministic code-level harness mirroring the kernel
  struct + `rssadapt_lower_rate` write logic, with a canary to detect OOB.
- `build.sh [buggy|fixed]` — builds the harness with the buggy `[8]` dim
  (default) or the fixed `[15]` dim (`-DTHRESH_COLS=IEEE80211_RATE_MAXSIZE`).
- `run.sh` — runs the already-built harness.
- `fix.diff` — git-apply-able fix: resize `ra_rate_thresh` to `[IEEE80211_RATE_MAXSIZE]`
  + update the 3 `thrs` typedefs.
- `VERDICT.md` — full narrative + mechanism + citations.
- `build.log` / `run.log` — baseline (buggy) build+run on the unpatched `#0` kernel.
- `fix_run.log` — fixed-dim build+run on the patched `#1` kernel.
- `fix_build.log` — full `make nativekernel` log for the single-fix kernel.
- `fix_install.log` — `make installkernel` log.
- `env.txt` — guest uname / cc / module state / default-ratectl citations.

## Reproduce
```
sh build.sh buggy && ./df0730_harness    # exit 1: OOB / canary clobbered / -Warray-bounds
sh build.sh fixed && ./df0730_harness    # exit 0: IN-BOUNDS / canary intact
```

## Expected
- Buggy build (matches master): harness prints `OUT-OF-BOUNDS ... heap OOB WRITE
  confirmed`, exit 1; gcc emits `array subscript 14 is above array bounds`.
- Fixed build: harness prints `IN-BOUNDS ... BUG FIXED`, exit 0; no warning.
- On the patched single-fix kernel (`6.5-DEVELOPMENT #1`) the OOB is gone.

## Why not a live kernel trigger
No WiFi radio on the guest (`ifconfig -l` ⇒ `vtnet0 lo0`), `wlan_rssadapt` is
`optional` (not in the default kernel), and no in-tree driver selects RSSADAPT
(default is AMRR). The bug is latent; the harness is the deterministic proof.