===== BUGGY (matches master ieee80211_rssadapt.c:322-338) =====
>> cc  -Wall -O2 -o df0731_harness df0731_harness.c
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  7952 Jul  9 02:08 df0731_harness
DF-0731 rssadapt_tx_complete NULL-arg2 deref harness
Build mode: BUGGY (matches master ieee80211_rssadapt.c:322-338)
Call: rssadapt_tx_complete(ra, success=0, arg1=&pktlen, arg2=NULL)
       (every in-tree driver: urtwn/ral/wpi/iwn/iwm pass NULL, bwn passes 0)

  [deref] *(int *)arg2(rssi) with arg2(rssi)==NULL  ->  in-kernel: fatal trap 12 / panic

=== VERDICT ===
NULL-DEREF: line 327 reached *(int *)arg2 with arg2==NULL.
In-kernel this is: fatal trap 12 (page fault on NULL) / panic -> DoS.
BUG PRESENT: rssadapt_tx_complete unconditionally derefs arg2.
BUGGY_EXIT=1

===== FIXED (NULL-check guard, models fix.diff) =====
>> cc -DFIX_NULL_CHECK -Wall -O2 -o df0731_harness df0731_harness.c
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  7632 Jul  9 02:08 df0731_harness
DF-0731 rssadapt_tx_complete NULL-arg2 deref harness
Build mode: FIXED (NULL-check guard present, models fix.diff)
Call: rssadapt_tx_complete(ra, success=0, arg1=&pktlen, arg2=NULL)
       (every in-tree driver: urtwn/ral/wpi/iwn/iwm pass NULL, bwn passes 0)


=== VERDICT ===
NO DEREF: NULL-arg guard returned early; line-327 load never reached.
rssi callbacks reached: lower=0 raise=0 (must be 0/0).
BUG FIXED: rssadapt_tx_complete no longer derefs NULL arg2/arg1.
FIXED_EXIT=0
RUNNER_EXIT=0