{
  "finding_id": "DF-3288",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "ms_known_gates gate entries (kmalloc M_80211_MESH_GT_RT) have no free path anywhere in sys/ and are not flushed in mesh_vdetach. 500 injected GANN action frames with fresh gate addresses grew the 80211mesh_gt zone to 503 entries / 19.6K; ifconfig wlan0 destroy freed none of them; a second vap cycle added 100 more (603/23.6K) and leaked them again. Unauthenticated (post-auto-peering) remote unbounded kernel heap growth, permanent across vap churn.",
  "exploit_chain": "attacker peers (1 beacon + OPEN + CONFIRM) -> floods 19-byte GANN action frames with unique gann_addr -> one kmalloc per frame, never freed -> kernel memory exhaustion -> OOM/degradation of the mesh node (and of any later vap that shares the zone accounting)",
  "evidence": "run.log: vmstat -m 503 -> destroy -> 503 -> +100 -> 603 -> destroy -> 603",
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:2662",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:2675",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:646",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:907"
  ],
  "poc_changes": "harness step 20 (count-configurable GANN flood with fresh gate addrs); observation via vmstat -m zone 80211mesh_gt",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-3286/build.sh",
  "run_cmd": "sh findings/poc/DF-3288/run.sh",
  "code_hash": "1b0e0b1a43331b1bc92e2614476535a88b88d3863db6ef91a36eead5c8ad7503",
  "notes": "distinct from DF-0289 (that is the dangling gr_route pointer); this is the missing free / unbounded growth",
  "recommended_fix": "flush ms_known_gates in mesh_vdetach (fix.diff hunk 7); consider aging entries when their route expires",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Thu Sep 10 05:34:08 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix kernel)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "200 GANNs -> 201 in-use; ifconfig wlan0 destroy -> in-use 0 (baseline: 503 persisted); mesh_vdetach now flushes ms_known_gates",
  "fix_evidence": [
    "fix.log: vmstat -m 201 -> 0 after destroy"
  ]
}