== patched guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Thu Sep 10 21:29:25 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
wlan0
wlan0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,PROXY> metric 0 mtu 1500
	status: associated
== step 1 (regression): auth request seq1 -> AP must still answer seq2 challenge
kern.fw4_attack: 0 -> 0
== attack: cleartext seq3 with captured challenge -> must NOT authorize
kern.fw4_attack: 0 -> 0
kern.fw4_state: 0
== follow-on assoc (baseline: associd 0xc001) -> must be refused now
kern.fw4_attack: 0 -> 0
kern.fw4_state: 0
fw4: fake legacy wifi radio attached (fw4_0, 11bg)
fw4_0: need multicast update callback
fw4_0: need multicast update callback
fw4.attack=1: injecting 30-byte frame (AUTH shared seq1) to wlan0
fw4[air]: AP TX AUTH seq=2 status=0 challenge_ie_len=128 protected=0
fw4.attack=1 done: captured challenge (len 128) off the air; AP tx seq=2 status=0
fw4.state[current]: node 0xfffff80118983400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff8008f8ecf80
fw4.attack=2: injecting 160-byte frame (AUTH shared seq3 +captured challenge, CLEARTEXT) to wlan0
fw4.attack=2 done: AP last tx AUTH seq=2 status=0
fw4.state[current]: node 0xfffff80118983400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff8008f8ecf80
fw4.attack=4: injecting 41-byte frame (ASSOC_REQ) to wlan0
fw4[air]: AP TX MGMT subtype 0xc0
fw4.state[after-assoc]: node 0xfffff80118983400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff8008f8ecf80
fw4.state[current]: node 0xfffff80118983400 flags 0x20020 authmode 2 AUTHORIZED=0 associd 0x0 challenge=0xfffff8008f8ecf80
FIXCHECK_DONE