{
  "finding_id": "DF-3313",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "ieee80211_recv_bar (ieee80211_ht.c:977-1050) reads wh->i_ctl/wh->i_seq through byte offset 19 with no own length check; every vap ctl dispatch path guarantees only sizeof(ieee80211_frame_min)=10 bytes before calling it (contrast: ACTION frames are length-verified per subtype in ieee80211_parse_action before dispatch). A short BAR delivered by a driver/injection is an OOB read of up to 10 bytes past valid mbuf data. Sinks are bit-masked (TID 4 bits, seq 12 bits) so there is no corruption/leak; worst case a boundary page-fault panic. Not executed: Low severity, Phase V conditional rule not met. The absent check is certain from source; manifestation depends on the radio driver delivering short ctl frames.",
  "exploit_chain": "",
  "evidence": [
    "README.md: dispatch-path analysis with path:line for every ctl entry (sta.c:926, hostap.c:2248, adhoc.c:949) vs the action-path contrast (ieee80211_input.c:754-803)"
  ],
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_ht.c:994",
    "sys/netproto/802_11/wlan/ieee80211_ht.c:996",
    "sys/netproto/802_11/wlan/ieee80211_ht.c:1009",
    "sys/netproto/802_11/wlan/ieee80211_sta.c:926"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "n/a (not executed)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low/OOB-read only; masked sinks; recommended m_pkthdr.len >= sizeof(struct ieee80211_frame_bar) guard included in README.md. Would share the DF-3282/3312 injection harness if triage wants it reproduced.",
  "recommended_fix": "Reject BAR frames shorter than sizeof(struct ieee80211_frame_bar) at the top of ieee80211_recv_bar (see README.md diff)."
}