# DF-3287 VERDICT — REPRODUCED (panic on stock INVARIANTS kernel; single remote frame)

## Reproduction

Stock kernel X86_64_GENERIC #0 (INVARIANTS), clean-snapshot guest. Mesh
vap up (meshid pwn, HWMP/AIRTIME, default AP|FWD flags). Harness
(fwm.ko, shared with DF-3286) performs the synchronous peering dance
(beacon → OPEN → CONFIRM; victim reaches ni_mlstate=ESTABLISHED —
fwm_tx log shows victim OPEN, victim CONFIRM, then the HWMP proactive
PREQ that mesh_linkchange(ESTABLISHED) triggers, proving the link).

Then ONE 54-byte unicast DSTODS QoS data frame, AE=01 mesh control:

* addr3 = 00:66:66:66:66:66 (== mc_addr4 → mesh_checkpseq created a
  route for it, so `rt_meshda` lookup succeeds),
* addr4 = 00:77:88:99:aa:bb (never routed → `rt_meshsa` == NULL).

Result (serial console, vm.sh log — full text in panic.txt):

    panic: no route
    mesh_input() at mesh_input+0x127b          <- inlined to_fwrd KASSERT (:1442)
    ieee80211_input_mimo() at ieee80211_input_mimo+0x156
    inject() at inject+0x75                    <- harness (== driver RX path)
    fwm_step_sysctl() ...

Guest wedged in ddb; required vm.sh reset.

## Root cause chain

mesh_input:1758-1768 ensures a route only for the AE-specific SA
(mc_addr4 for AE=01); to_fwrd/to_me then KASSERT-and-deref a route for
qwh->i_addr4 (1441-1444, 1482-1484) which for AE=01 4-address frames is
attacker-chosen and routinely unrouted. INVARIANTS → KASSERT panic;
production → ieee80211_mesh_rt_update(NULL) → MESH_RT_ENTRY_LOCK(NULL) →
lockmgr write near NULL → fatal fault. Same class also reachable via
to_me's ae KASSERT (1488) with AE=01/AE=11 unicast-to-me frames.

## Impact

Remote kernel panic (DoS) from an established mesh peer; peering is
auto-granted by default. Repeated at will (one frame each time).

## Fix validation

fix.diff hunks #2/#3 replace both KASSERT+deref with NULL-checked
discards. Fixed-kernel rerun: step 11 frame is silently discarded
(error == -1 path), guest stays up, link remains established
(subsequent valid frames still process). See DF-3286 run.log fix section.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)