############################################################
# BUGGY transcription (matches sys/netproto/802_11/wlan_acl/ieee80211_acl.c)
############################################################

===== BUGGY: GROW race (N=8 K=4) — expect OOB WRITE =====
=== DF-0732 harness (BUGGY transcription: matches ieee80211_acl.c current source) ===
  mode=grow N=8 K=4  IEEE80211_ADDR_LEN=6

  [harness] N=8 K=4  as_nacls@read=8  space=48 bytes  list@foreach had 12 entries
  [harness] foreach wrote 72 bytes into 48-byte buffer (oob_flag=1)
  [harness] GROW: 24 OOB bytes overwritten past kmalloc end (attacker MAC bytes landed in red zone)
GROW RACE OOB WRITE CONFIRMED

[exit rc=1]

===== BUGGY: SHRINK race (N=8 K=4) — expect UNINIT LEAK =====
=== DF-0732 harness (BUGGY transcription: matches ieee80211_acl.c current source) ===
  mode=shrink N=8 K=4  IEEE80211_ADDR_LEN=6

  [harness] N=8 K=4  as_nacls@read=8  space=48 bytes  list@foreach had 4 entries
  [harness] foreach wrote 24 bytes into 48-byte buffer (oob_flag=0)
  [harness] SHRINK: 4 tail slots uninitialized (heap residue would be shipped by copyout = info leak)
SHRINK RACE UNINIT LEAK CONFIRMED

[exit rc=1]

############################################################
# FIXED transcription (lock-before-read :313 + M_ZERO :319 + bounded foreach :329)
############################################################

===== FIXED: GROW race (N=8 K=4) — expect NOT TRIGGERED =====
=== DF-0732 harness (FIXED transcription: lock-before-read + M_ZERO + bounded foreach) ===
  mode=grow N=8 K=4  IEEE80211_ADDR_LEN=6

  [harness] N=8 K=4  as_nacls@read=8  space=48 bytes  list@foreach had 8 entries
  [harness] foreach wrote 48 bytes into 48-byte buffer (oob_flag=0)
  [harness] GROW: red zone intact — no OOB write
GROW RACE: NOT TRIGGERED (no OOB write)

[exit rc=0]

===== FIXED: SHRINK race (N=8 K=4) — expect NOT TRIGGERED =====
=== DF-0732 harness (FIXED transcription: lock-before-read + M_ZERO + bounded foreach) ===
  mode=shrink N=8 K=4  IEEE80211_ADDR_LEN=6

  [harness] N=8 K=4  as_nacls@read=8  space=48 bytes  list@foreach had 8 entries
  [harness] foreach wrote 48 bytes into 48-byte buffer (oob_flag=0)
  [harness] SHRINK: all tail slots zeroed/valid — no uninit leak
SHRINK RACE: NOT TRIGGERED (no uninit tail)

[exit rc=0]

############################################################
Run complete.