# DF-0732 — TOCTOU in wlan_acl acl_getioctl MACCMD_LIST

**Verdict:** REPRODUCED (heap OOB write + uninit-heap info leak); fix VALIDATED.
**Severity:** High. **CWE:** CWE-787 (OOB write), CWE-908 (uninit memory).

## The bug
`sys/netproto/802_11/wlan_acl/ieee80211_acl.c:313` reads `as->as_nacls` WITHOUT
`ACL_LOCK` (taken only at `:328`) to size the `kmalloc(space, M_TEMP, M_INTWAIT)`
at `:319` (no `M_ZERO`), then `TAILQ_FOREACH` (`:329-332`) writes every current
list entry unbounded. A concurrent ADDMAC/DELMAC between `:313` and `:328` makes
the list diverge from the buffer size:
- **Grow** → OOB heap write of attacker-controlled MAC bytes past the buffer.
- **Shrink** → uninitialized tail shipped to userland by `copyout` (info leak).

## Reproduce (userspace deterministic harness — PRIMARY proof)
```
sh build.sh     # builds harness (BUGGY) + harness_fixed (FIXED)
sh run.sh       # BUGGY => both races CONFIRMED; FIXED => both NOT TRIGGERED
```

## Reproduce (real-kernel object-level harness — needs root to kldload)
```
# build harness_mod.ko (in guest, as root):
cd /root/df0732 && make SYSDIR=/usr/src/sys KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
kldload wlan; kldload wlan_acl; sysctl debug.use_malloc_pattern=1
kldload ./harness_mod.ko          # exposes /dev/df0732 (0666)
# as unprivileged user:
cc -O2 -pthread -o trigger trigger.c    && ./trigger  200000 4   # unpatched => panic
cc -O2 -pthread -o leakcheck leakcheck.c && ./leakcheck 100000 4  # fixed => WEIRD_ADDR=0
```

## Runtime reachability
The live ACL ioctl path needs a `wlan(4)` vap on a wifi radio — absent on this
KVM guest (`ifconfig -l` = `vtnet0 lo0`). The bug is proven at the object/harness
level (real `acl_getioctl` panic + leak) and via deterministic transcription. On
a wifi host with a vap, a local user could race ADDMAC vs MACCMD_LIST.

## Fix
`fix.diff`: move `ACL_LOCK` before the `as_nacls` read, add `M_ZERO`, bound the
foreach. Validated: rebuilt `wlan_acl.ko` clean, reloaded, no panic + zero
`WEIRD_ADDR` residue.

## Files
- `harness.c` — deterministic userspace transcription (PRIMARY proof)
- `harness_mod.c` / `Makefile` — real-kernel object-level harness module
- `trigger.c` — userspace racer (grow panic / shrink leak)
- `leakcheck.c` — definitive WEIRD_ADDR residue classifier
- `fix.diff` — git-apply-able fix (lock-before-read + M_ZERO + bounded foreach)
- `VERDICT.md` — full narrative + line-by-line analysis + before/after
- `*.log` — full untrimmed build/run/panic/leak logs