# DF-3284 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
raw 802.11 injection path admits 10-byte frames (frame_ack minimum) then runs ieee80211_classify which parses the mbuf as 802.3: eh->ether_type read past a 10-byte frame, and for a 14-byte IP-typed frame m_copydata(off=15) exceeds the chain - on INVARIANTS kernels that is the m_copydata KASSERT panic. Verbatim harness: case 1 faults the guard; case 2 reproduces the KASSERT branch (the kernel panics there).

## Build
```
./build.sh
```

## Run
```
df3284 1
```
(success criterion: see VERDICT.md)

## Evidence
case 1 rc=139 (guard); case 2 emits the m_copydata KASSERT-fire proof; control rc=0; FIXED 802.3-header gate clean

Kernel references: sys/netproto/802_11/wlan/ieee80211_output.c:715, sys/netproto/802_11/wlan/ieee80211_output.c:723-736, sys/netproto/802_11/wlan/ieee80211_output.c:1180-1240, sys/kern/uipc_mbuf.c:m_copydata