THRESH_COLS (ra_rate_thresh 2nd dim) = 8
IEEE80211_RATE_SIZE    = 8
IEEE80211_RATE_MAXSIZE = 15
IEEE80211_RSSADAPT_BKTS= 3
sizeof(struct ieee80211_rssadapt_node) = 104
offsetof(ra_rate_thresh)               = 52
sizeof(ra_rate_thresh[0])              = 16

Trigger: rs_nrates=12, max rix=11, pktlen=1500 -> bucket=2
Worst-case rix (rs_nrates=15) = 14

Write landed at offset 112 within the allocation.
struct end is at offset 104.

=== VERDICT ===
OUT-OF-BOUNDS: write at off 112 is 10 byte(s) PAST the struct (struct ends at 104).
Canary clobbered past struct end: YES (heap OOB WRITE confirmed)
BUG PRESENT: ra_rate_thresh[3][8] indexed by rix=14 -> OOB.
harness exit code: 1
RUN_EXIT=0