# DF-3325 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
hostap_input pre-dispatch rx-sequence block reads i_seq (offset 22) and i_qos (offset 24) of TODS/DSTODS frames with only the 10-byte frame_ack minimum guaranteed (the >=24-byte check guards only the NODS bssid path). Verbatim harness with a 10-byte TODS QoS data frame faults the guard page.

## Build
```
./build.sh
```

## Run
```
df3325 oob
```
(success criterion: see VERDICT.md)

## Evidence
control (30-byte frame) rc=0; 10-byte frame rc=139; FIXED length gate clean

Kernel references: sys/netproto/802_11/wlan/ieee80211_hostap.c:551-590, sys/netproto/802_11/ieee80211_proto.h:337-350