# DF-3324 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
hostap assoc path accepts a minimal (len=4) Atheros vendor IE via isatherosoui() and ieee80211_parse_ath() then reads ath_capability+ath_defkeyix (bytes 6..8) past the 6-byte saved-IE allocation (SUPERG kernels; wlan module absent on this radio-less guest so verbatim harness: 3-byte heap over-read faults the guard page).

## Build
```
./build.sh
```

## Run
```
df3324 oob
```
(success criterion: see VERDICT.md)

## Evidence
control (16-byte alloc) rc=0; 6-byte saveie allocation + parse_ath faults rc=139; FIXED length check clean

Kernel references: sys/netproto/802_11/wlan/ieee80211_hostap.c:2007, sys/netproto/802_11/wlan/ieee80211_hostap.c:2155-2160, sys/netproto/802_11/wlan/ieee80211_superg.c:199-207, sys/netproto/802_11/ieee80211_input.h:111-115