# DF-2578 — PoC verdict

**File:** `sys/netproto/802_11/wlan/ieee80211_tdma.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

ieee80211_parse_tdma() calls setbit(ts->tdma_inuse, tdma->tdma_slot) using the unchecked tdma_slot from an untrusted beacon/probe-response IE. tdma_inuse is only 1 byte (uint8_t[1]); setbit(a,i)=a[i/8]|=..., so any tdma_slot>=8 writes past the array into adjacent heap fields. The sibling tdma_process_params validates slot, this path omits it.

### Cited lines

- `sys/netproto/802_11/wlan/ieee80211_tdma.c:649-658`
- `sys/netproto/802_11/ieee80211_tdma.h:58`

## Why it does not reproduce on this guest

No wifi adapter / TDMA vap on the QEMU guest (ifconfig shows only vtnet0/lo0; no 802.11 vap in TDMA/ahdemo mode). The TDMA wlan code is compiled in but cannot attach without a wifi NIC.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Validate tdma_slot < NBBY*sizeof(tdma_inuse) before setbit; return if out of range.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)