{
  "finding_id": "DF-3290",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "mesh_parse_meshgate_action copies the 15-byte GANN body from any MESHGANN IE without checking gann_len, while the IE walk only guarantees frm[1]+2 bytes present. A GANN IE declaring len=0 at the end of a padded action frame made the victim parse 15 bytes beyond the IE and re-broadcast them: the propagated GANN (captured at the radio) carried the marker bytes as gate addr b3:b4:b5:b6:b7:b8, seq 0xb9b9b9b9, ttl 0xb1, interval 0xbebd. Remote OOB read (up to 15 bytes of stale mbuf data) exfiltrated over the air.",
  "exploit_chain": "established peer sends CAT_MESH GANN action whose GANN IE declares len=0, padded so the total-length check passes and the trailing bytes double as a final valid IE -> parser reads 15 bytes past the IE -> gate stored from those bytes -> GANN re-broadcast to the whole mesh carries the out-of-bounds bytes",
  "evidence": "run.log: tx[29] propagated GANN containing the beyond-IE markers b3..be",
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:2583",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:2586",
    "sys/netproto/802_11/wlan/ieee80211_mesh.c:2595"
  ],
  "poc_changes": "harness step 21; the 15 trailing bytes double as a valid final IE (00 0d ...) so the walk survives to the propagation stage",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-3286/build.sh",
  "run_cmd": "sh findings/poc/DF-3290/run.sh",
  "code_hash": "1b0e0b1a43331b1bc92e2614476535a88b88d3863db6ef91a36eead5c8ad7503",
  "notes": "bounded stale-data read; values also pollute the permanent gate table (see DF-3288)",
  "recommended_fix": "reject GANN IEs whose frm[1] != IEEE80211_MESHGANN_BASE_SZ (fix.diff hunk 6)",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Thu Sep 10 05:34:08 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (fix kernel)",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "short GANN (IE len=0) no longer propagated (baseline re-broadcast the markers); rejected by the new frm[1] != MESHGANN_BASE_SZ check",
  "fix_evidence": [
    "fix.log: no len-43 propagated frame after step 21"
  ]
}