{
  "finding_id": "DF-3326",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "auth_bypass (association without authentication: AID assignment, powersave eligibility, EAPOL passthrough, assoc-flood DoS)",
  "confidence": "certain",
  "verdict": "hostap_recv_mgmts ASSOC_REQ gate (:1953) tests only ni == iv_bss, but hostap_auth_shared creates the node on a single auth REQUEST (:1072 dup_bss) before the exchange completes. One 30-byte REQUEST + one ASSOC_REQ = associated station (associd 0xc001) with AUTHORIZED=0, reproduced on the stock kernel; the no-node control correctly gets DEAUTH (0xc0). Found while validating the DF-3323 fix, where the patched kernel still handed out the association.",
  "exploit_chain": "1) inject AUTH shared seq1 (node created, not authorized); 2) inject ASSOC_REQ -> ASSOC_RESP + AID; 3) repeat with distinct source MACs to exhaust the 128-entry AID space (remote assoc-flood DoS) or hold assoc state + EAPOL passthrough",
  "evidence": "run.log: control AP TX MGMT subtype 0xc0 (DEAUTH, correct), attack AP TX MGMT subtype 0x10 (ASSOC_RESP) + associd 0xc001 ... AUTHORIZED=0; fix.log: patched = 0xc0 + associd 0x0; regression open-auth assoc still 0xc001",
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_hostap.c:1953",
    "sys/netproto/802_11/wlan/ieee80211_hostap.c:1072",
    "sys/netproto/802_11/wlan/ieee80211_hostap.c:2169",
    "sys/netproto/802_11/wlan/ieee80211_node.c:2524"
  ],
  "poc_changes": "same fw4 harness as DF-3323; fw4.c extended with generic mgmt-subtype TX capture (0xc0/0x10 distinction), attack=4 fallback to iv_bss for the no-node control, attack=6 open-auth regression leg",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (baseline) / #1 21:29:25 UTC 2026 (fix validation)",
  "runtime_sec": 1200,
  "guest_dirty": 0,
  "build_cmd": "sh findings/poc/DF-3326/build.sh",
  "run_cmd": "sh findings/poc/DF-3326/run.sh ; sh findings/poc/DF-3326/fixcheck.sh",
  "code_hash": "4bf00201a1d2ae127b246f2ad2f87e3ec930c17741b396f09e7279f55c9f36f5",
  "notes": "independent of DF-3323 (survives the DF-3323 fix); discovered during DF-3323 fix validation when associd was still granted to an unauthorized station. Upstream FreeBSD has the same ni==iv_bss predicate.",
  "recommended_fix": "Widen the assoc gate: deny when ni==iv_bss OR (ni_authmode in {SHARED, AUTO} AND port not authorized); see fix.diff",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Thu Sep 10 21:29:25 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "make -j6 nativekernel rc=0 with DF-3326 fix.diff (+DF-3323 fix); baseline assoc grant (0x10 + associd 0xc001) is gone: DEAUTH 0xc0, associd 0x0; regression: open-auth vap authorizes + associates normally (0xc001).",
  "fix_evidence": "findings/poc/DF-3326/fix.log (kernel #1 21:29, both fixes)"
}