>> building harness (fixed): cc -DTHRESH_COLS=IEEE80211_RATE_MAXSIZE -Wall -O2 -o df0730_harness df0730_harness.c
>> built df0730_harness (rc=0)
BUILD_EXIT=0
THRESH_COLS (ra_rate_thresh 2nd dim) = 15
IEEE80211_RATE_SIZE    = 8
IEEE80211_RATE_MAXSIZE = 15
IEEE80211_RSSADAPT_BKTS= 3
sizeof(struct ieee80211_rssadapt_node) = 144
offsetof(ra_rate_thresh)               = 52
sizeof(ra_rate_thresh[0])              = 30

Trigger: rs_nrates=12, max rix=11, pktlen=1500 -> bucket=2
Worst-case rix (rs_nrates=15) = 14

Write landed at offset 140 within the allocation.
struct end is at offset 144.

=== VERDICT ===
IN-BOUNDS: write at off 140 is within the struct (ends 144). No OOB.
Canary intact: YES
BUG FIXED: ra_rate_thresh[3][15] safely holds rix=14.
harness exit code: 0
RUN_EXIT=0