=== PATCHED-source validation (FIXED transcription == patched ieee80211_acl.c) ===
Patch: ACL_LOCK moved before as_nacls read (:313) + M_ZERO (:319) + bounded foreach (:329)

--- FIXED: GROW race (N=8 K=4) ---
=== DF-0732 harness (FIXED transcription: lock-before-read + M_ZERO + bounded foreach) ===
  mode=grow N=8 K=4  IEEE80211_ADDR_LEN=6

  [harness] N=8 K=4  as_nacls@read=8  space=48 bytes  list@foreach had 8 entries
  [harness] foreach wrote 48 bytes into 48-byte buffer (oob_flag=0)
  [harness] GROW: red zone intact — no OOB write
GROW RACE: NOT TRIGGERED (no OOB write)

[exit rc=0]

--- FIXED: SHRINK race (N=8 K=4) ---
=== DF-0732 harness (FIXED transcription: lock-before-read + M_ZERO + bounded foreach) ===
  mode=shrink N=8 K=4  IEEE80211_ADDR_LEN=6

  [harness] N=8 K=4  as_nacls@read=8  space=48 bytes  list@foreach had 8 entries
  [harness] foreach wrote 48 bytes into 48-byte buffer (oob_flag=0)
  [harness] SHRINK: all tail slots zeroed/valid — no uninit leak
SHRINK RACE: NOT TRIGGERED (no uninit tail)

[exit rc=0]

--- FIXED: GROW race (N=32 K=16) stress ---
=== DF-0732 harness (FIXED transcription: lock-before-read + M_ZERO + bounded foreach) ===
  mode=grow N=32 K=16  IEEE80211_ADDR_LEN=6

  [harness] N=32 K=16  as_nacls@read=32  space=192 bytes  list@foreach had 32 entries
  [harness] foreach wrote 192 bytes into 192-byte buffer (oob_flag=0)
  [harness] GROW: red zone intact — no OOB write
GROW RACE: NOT TRIGGERED (no OOB write)

[exit rc=0]

--- FIXED: SHRINK race (N=32 K=16) stress ---
=== DF-0732 harness (FIXED transcription: lock-before-read + M_ZERO + bounded foreach) ===
  mode=shrink N=32 K=16  IEEE80211_ADDR_LEN=6

  [harness] N=32 K=16  as_nacls@read=32  space=192 bytes  list@foreach had 32 entries
  [harness] foreach wrote 192 bytes into 192-byte buffer (oob_flag=0)
  [harness] SHRINK: all tail slots zeroed/valid — no uninit leak
SHRINK RACE: NOT TRIGGERED (no uninit tail)

[exit rc=0]

############################################################
# REAL-KERNEL Phase 8 validation (fixed wlan_acl.ko, sha256 c23e324c...)
############################################################
# Fixed module loaded (rebuilt from patched source: lock-before-read + M_ZERO
# + bounded foreach).  Same harness_mod.ko + trigger/leakcheck exercising the
# REAL acl_getioctl via /dev/df0732.  debug.use_malloc_pattern=1 so any uninit
# slab residue would carry WEIRD_ADDR (0xdeadc0de).

=== FIXED module: trigger (grow-race OOB check) — expect NO PANIC ===
trigger: 241489 LIST ioctls, no panic, guest stayed UP (grow race eliminated)

=== FIXED module: leakcheck (shrink-race residue check) — expect WEIRD_ADDR=0 ===
leakcheck: 77004 LIST ioctls
  adder/seed MAC slots : 116921936
  ZERO (M_ZERO) slots  : 0          (buffer exactly filled: space==nacls*6, no tail)
  WEIRD_ADDR residue   : 0   (none — leak eliminated)
  OTHER (suspicious)   : 0
LC_EXIT=0   guest UP, NO PANIC