# DF-3287 — Remote kernel panic via unvalidated AE=01 unicast mesh data frame (route for addr4 never ensured; KASSERT/NULL-deref)

File: `sys/netproto/802_11/wlan/ieee80211_mesh.c` (pass 2 audit)

## What

`mesh_input`'s duplicate-sequence check (:1756-1768) only creates a
routing-table entry for the **AE-specific source address**:

```c
if (IEEE80211_IS_MULTICAST(wh->i_addr1))  addr = wh->i_addr3;
else if (ae == IEEE80211_MESH_AE_01)      addr = MC01(mc)->mc_addr4;  /* proxy SA in mesh control */
else                                      addr = qwh->i_addr4;
if (mesh_checkpseq(vap, addr, seq) != 0) ...   /* adds route for `addr` only */
```

But the unicast forward/local paths then look up and **unconditionally
dereference a route for the 802.11 header's addr4**:

```c
/* mesh_recv_indiv_data_to_fwrd :1441 */
rt_meshsa = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
KASSERT(rt_meshsa != NULL, ("no route"));
ieee80211_mesh_rt_update(rt_meshsa, ...);      /* MESH_RT_ENTRY_LOCK(rt) */

/* mesh_recv_indiv_data_to_me :1482 */
rt = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
KASSERT(rt != NULL, ("no route"));
ieee80211_mesh_rt_update(rt, ...);
```

An AE=01 (proxy source in mesh control) **4-address unicast** data frame
whose `i_addr4` is any never-routed MAC reaches these lines with
`rt == NULL`:

* INVARIANTS kernels: `panic: no route` (proven on the stock guest).
* production kernels: `MESH_RT_ENTRY_LOCK(NULL)` → lockmgr write at
  ~NULL → fatal page fault.

A second variant: `to_me` KASSERTs `ae == AE_00 || ae == AE_10` (:1488)
— an AE=11 or AE=01 frame addressed *to* the victim panics INVARIANTS
kernels even before the route deref.

## Reproduced (stock kernel)

```
fwm: inject UCAST AE=1 data (54 bytes; addr4 unroute'd)
panic: no route
cpuid = 1
Trace beginning at frame 0xfffff8011836b4d8
mesh_input() at mesh_input+0x127b
ieee80211_input_mimo() at ieee80211_input_mimo+0x156
inject() at inject+0x75
fwm_step_sysctl() at fwm_step_sysctl+0x1d9
Debugger("panic")
```
(see `panic.txt`; single 54-byte frame from an established mesh peer —
the peer link is auto-established by the victim from one beacon.)

## Build / run (repo root)

```
sh findings/poc/DF-3286/build.sh           # shared harness
sh findings/poc/DF-3287/run.sh             # panics the stock guest
```

## Threat

Remote unauthenticated-after-peering kernel panic (single frame).
802.11s mesh STAs auto-peer by default (`ms_flags = AP|FWD`, :683), so
"established peer" costs the attacker one beacon + two action frames.
CWE-690 / CWE-20 (missing validation → NULL deref / DoS).