# DF-1400 — wi_write_wep LUCENT WEP-key stack overflow (PoC)

## Summary
`wi_write_wep` LUCENT branch (`sys/dev/netif/wi/if_wi.c:1766-1769`) does
`memcpy(wkey[i].wi_keydat, wk_key, keylen)` with `keylen` up to
`IEEE80211_KEYBUF_SIZE=16` into `wi_keydat[14]`, overflowing by 1-2 bytes per
slot; on the last slot (`i==3`) the overflow runs off the `wkey[4]` stack array
into the frame. Triggered on a WiFi state transition (AUTH/RUN) calling
`wi_write_wep`. Requires `SYSCAP_NONET_WIFI`.

## Reachability
`wi(4)` is a loadable module (`if_wi.ko`), not in GENERIC, attaching only to
Prism/Lucent WiFi cards. The QEMU guest has no WiFi hardware, so the bug is
**not live-reachable here**. Proven deterministically with a byte-exact harness
replicating `struct wi_key` (`if_wavelan_ieee.h:290-292`) and the `wkey[4]`
stack array.

## Build / run
```sh
./build.sh && ./run.sh
```

## Expected output (bug present)
```
slot 3: wrote 16 bytes into 14-byte wi_keydat -> 2 byte(s) past end [runs OFF the wkey[4] array into the frame]
frame region after wkey[4] corrupted by last slot: YES
OVERFLOW CONFIRMED: keylen=16 > wi_keydat[14] overflows by 2 byte(s) per slot ...
```
On a fixed driver the copy is bounded to `sizeof(wi_keydat)` = 14.

## Fix
Clamp `keylen` to `sizeof(wkey[i].wi_keydat)` before the `memcpy` (`fix.diff`).
Validated to compile into a rebuilt `if_wi.ko` (`-Werror`, rc=0).

## Files
- `wi_overflow.c` — byte-exact harness.
- `build.sh` / `run.sh` / `run.log` / `env.txt` / `fix.diff` / `VERDICT.md` / `manifest.json`.