# DF-3292 — SIOCS80211 MESH_RTCMD ADD/DELETE dereference the user-supplied `ireq->i_data` pointer directly in kernel

File: `sys/netproto/802_11/wlan/ieee80211_mesh.c` (pass 2 audit)

## What

`mesh_ioctl_set80211` (:3653-3663):

```c
case IEEE80211_MESH_RTCMD_ADD:
        if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||   /* raw user ptr */
            IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))      /* raw user ptr */
                return EINVAL;
        error = copyin(ireq->i_data, &tmpaddr, IEEE80211_ADDR_LEN);  /* proper copyin AFTER */
        ...
case IEEE80211_MESH_RTCMD_DELETE:
        ieee80211_mesh_rt_del(vap, ireq->i_data);                /* raw user ptr, NO copyin at all */
```

`IEEE80211_ADDR_EQ` reads 6 bytes from `i_data` in kernel context.
`i_data` is a user-controlled pointer from the ioctl (SIOCS80211,
requires SYSCAP_NONET_WIFI — checked at ieee80211_ioctl.c:3472).

Consequences for a privileged caller:
* passing an **invalid/unmapped kernel address** → kernel page fault →
  panic (privileged local DoS; verified at runtime, see below);
* passing any **mapped kernel address** → 6 bytes of arbitrary kernel
  memory compared against routing-table destinations — an
  arbitrary-address 6-byte read gadget whose side effect (route deleted
  or not) is observable, i.e. a constrained kernel-memory oracle;
* on the DELETE path there is no copyin at all — robustness/standards
  bug (user pages must not be dereferenced directly; breaks under
  SMAP-capable platforms and colliding mappings).

## Runtime (fixed-kernel guest — bug path untouched by the 7-fix diff)

```
# ./setmeshdel wlan0
issuing MESH_RTCMD_DELETE with kernel i_data=0xffffffff81234000...
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffff81234000
```
(panic.txt)

## Build / run

```
sh findings/poc/DF-3286/build.sh && vm.sh run_root "cc -o /root/fwm/setmeshdel /root/fwm/setmeshdel.c"
sh findings/poc/DF-3292/run.sh
```

## Fix

copyin the 6-byte address first, compare/delete the kernel copy (same
discipline the ADD path uses after its check).

Severity Low (privileged-only, but a raw user/kernel-pointer deref).
CWE-822.