{
  "finding_id": "DF-3289",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "mesh_peer_timeout_cb transmits CLOSE frames with args[1] (peer link id) never initialized in the MAX_RETRIES (:3108) and CONFIRM_TIMEOUT (:3126) branches - source-certain CWE-457. On the stock guest the captured timeout CLOSEs (both retry and confirm-timeout paths) were emitted in short form because the uninitialized stack slot read 0, so no kernel-stack bytes were observed on air and no behavior change was observable. Latent 2-byte kernel-stack info leak to any mesh peer whose stack garbage is non-zero.",
  "exploit_chain": "attacker beacons victim into auto-peering then goes silent (or confirms then goes silent) -> victim timeout_cb builds CLOSE with uninit args[1] -> if garbage != 0, long-form meshpeer IE transmits 2 uninit kernel-stack bytes in the Peer Link ID field to the attacker",
  "evidence": "run.sh output: captured CLOSE 75 06 0000 <llid> 3800 (short form, slot read 0) on both timeout paths",
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:3107",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:3125",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:2902"
  ],
  "poc_changes": "passive observation via harness TX capture; no special trigger needed beyond beacon+silence",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-3286/build.sh",
  "run_cmd": "sh findings/poc/DF-3289/run.sh",
  "code_hash": "1b0e0b1a43331b1bc92e2614476535a88b88d3863db6ef91a36eead5c8ad7503",
  "notes": "code defect certain; runtime disclosure not observed (deterministic 0 in the callout frame on this build)",
  "recommended_fix": "args[1] = 0 at function entry (fix.diff hunk 5)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Thu Sep 10 05:34:08 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix kernel)",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "args[1]=0 initialized at cb entry (hunk 5); compiled into validated kernel; runtime observable unchanged on this build (slot read 0 already)",
  "fix_evidence": [
    "fix.log: DF-3289 section"
  ]
}