Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3324 parse_ath 3-byte read past saved Atheros IE
    DF-3324: Atheros vendor IE (len=4) accepted by isatherosoui, parsed by ieee80211_parse_ath (no length check)
      isatherosoui = 1; saveie allocates frm[1]+2 = 6 bytes
      parse_ath reads ath_capability (byte 6) + defkeyix (7-8)
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3325 hostap pre-dispatch i_qos/i_seq past 10-byte frame
    DF-3325 (hostap_input pre-dispatch, hostap.c:580-590)
      frame: 10 bytes, TODS, QoS data; i_qos at offset 24, i_seq at 22
      pre-dispatch block: gettid reads i_qos[0]; check_rxseq reads i_seq
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3342 sta pre-dispatch i_qos/i_seq past 10-byte frame
    DF-3342 (sta_input pre-dispatch, sta.c:641-649)
      frame: 10 bytes, TODS, QoS data; i_qos at offset 24, i_seq at 22
      pre-dispatch block: gettid reads i_qos[0]; check_rxseq reads i_seq
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3416 adhoc pre-dispatch i_qos/i_seq past 10-byte frame
    DF-3416 (adhoc_input pre-dispatch, adhoc.c:410-419)
      frame: 10 bytes, TODS, QoS data; i_qos at offset 24, i_seq at 22
      pre-dispatch block: gettid reads i_qos[0]; check_rxseq reads i_seq
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3329 preq iefrm[33] past 3-byte IE
    DF-3329 (verify_mesh_preq_len / verify_mesh_perr_len, hwmp.c:317-386)
      PREQ: reads ndest at iefrm[33] of a 3-byte IE
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3329 perr iefrm[3] past 2-byte IE
    DF-3329 (verify_mesh_preq_len / verify_mesh_perr_len, hwmp.c:317-386)
      PERR: reads ndest at iefrm[3] of a 2-byte IE
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3329 perr dest-flag past 4-byte IE
    DF-3329 (verify_mesh_preq_len / verify_mesh_perr_len, hwmp.c:317-386)
      PERR walk: reads dest flag at iefrm[4]
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3341 tim_period (byte 4) past 3-byte TIM IE
    DF-3341 (TIM IE length never checked; tim_period read)
      TIM IE declared len=1; consumer reads tim_period (byte 4)
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3374 csa_newchan (byte 3) past 3-byte CSA IE
    DF-3374 (parse_csaparams: no frm[1] check)
      CSA len=1: csa_newchan (byte 3) past the IE
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3374 csa_count (byte 4) past 4-byte CSA IE
    DF-3374 (parse_csaparams: no frm[1] check)
      CSA len=2: csa_count (byte 4) past the IE
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3343 htrates[159] past 77-entry table
    DF-3343 (ic_txstream*8-1 unclamped into htrates[77], ieee80211.c:1620-1629)
      txstream=20 -> index 159 (83 entries past the 77-entry table)
      rate = ieee80211_htrates[i].ht20_rate_800ns
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3284 ether_type read past 10-byte raw frame
    DF-3284 (raw 10-byte frames parsed as 802.3 by classify)
      10-byte frame: classify reads eh->ether_type (12..13)
REPRODUCED (rc=0): DF-3284 m_copydata(off=15) past 14-byte chain
        m_copydata(off=15, len=1) on chain of 14 bytes
        KASSERT "m_copydata: offset > size of mbuf chain" FIRES (INVARIANTS kernel: panic)
      ran (in bounds), r=1
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3274 obytes read of freed mbuf pkthdr
    DF-3274 (obytes accounting reads freed mbuf, if_spppsubr.c :1372-1380/:1429-1438/:4672-4681)
      control queue full: m_freem(m), then obytes += m->m_pkthdr.len + 3
Segmentation fault (core dumped)
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3346 next SIOCSLAGG NULL-deref via lp_psc
    DF-3346 (sc_proto set before ti_attach; failed attach poisons the next SIOCSLAGG)
      attach FAILED (fault injection): error=12, sc_proto=1, ports lp_psc=NULL
      next SIOCSLAGG -> lacp_port_destroy derefs NULL lp_psc:
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3347 later LACP op NULL-deref via lp_psc
    DF-3347 (lacp_port_create failure ignored, if_lagg.c:2081)
      port1 lp_psc=0x8004901b8 port2 lp_psc=0x0 (failure silently ignored)
      later LACP op derefs NULL lp_psc:
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3322 rcvif NULL deref in 127/8 martian check
    DF-3322 (rcvif deref without NULL check, ip_input.c:544)
      crafted 127/8 packet queued with rcvif=NULL (ng_ip_input path)
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3393 rn_match reads stored key bytes 16..254
    DF-3393 (rn_match over-read bounded by caller clen only, radix.c:306-329)
      stored key alloc: 16 bytes; caller clen(key)=255
      rn_match exact-compare loop reads stored[0..254]
Segmentation fault (core dumped)
REPRODUCED (rc=139): DF-3442 kfnmatch scans past non-terminated name
    DF-3442 (kfnmatch on rule-supplied non-terminated name, ip_fw3_basic.c:134-141)
      name: 16 bytes, NOT terminated, glob=1
---- reproduced 19 cases via guard-page SEGV ----