{
 "finding_id": "DF-3327",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "A single broadcast-target HWMP PREQ action frame (origseq=0, metric=0, target=ff:ff:ff:ff:ff:ff with the TO bit) from an auto-peered mesh neighbor leaves the originator route INVALID with an all-zero nexthop, and hwmp_recv_preqs proactive branch (ieee80211_hwmp.c:1241-1254) still sends a PREP to that nexthop; hwmp_send_action resolves ieee80211_mesh_find_txnode(00:00:00:00:00:00) to NULL and hits KASSERT(ni != NULL) (:636) on INVARIANTS kernels (NULL-deref at :637 on production). Reproduced as panic: null node with a hwmp_send_action backtrace on the stock INVARIANTS kernel; fix.diff (NULL check + drop) validated: no panic, guest healthy, PREQ still forwarded.",
 "exploit_chain": "fwm software-radio injects 65-byte action frame after the beacon/OPEN/CONFIRM auto-peering dance -> ieee80211_input_mimo -> mesh_input -> hwmp_recv_action_meshpath -> verify+parse PREQ -> hwmp_recv_preq: rt_add(orig) M_ZERO route stays INVALID (origseq==stored 0, metric not better) -> proactive branch hwmp_send_prep(nexthop=00:00:00:00:00:00) -> hwmp_send_action: find_txnode returns NULL -> KASSERT null node panic (guest wedged in ddb). One frame per panic, repeatable.",
 "evidence": [
  "panic.txt: panic: null node + backtrace hwmp_send_action+0x4ee <- hwmp_recv_action_meshpath <- mesh_input <- ieee80211_input_mimo, preceded by fwm: inject HWMP PREQ origseq=0 targ=bc TO",
  "run.log: baseline session transcript (ssh hung at step-30 sysctl, RC=124)",
  "fix_build.log: make -j6 nativekernel + installkernel of fix.diff (kernel #1)",
  "fix_run.log: same PoC twice on fixed kernel - NO_PANIC_HERE / STILL_UP_AFTER_SECOND_PREQ, RC=0, guest up, forwarded PREQ still in txlog"
 ],
 "kernel_refs": [
  "sys/netproto/802_11/wlan/ieee80211_hwmp.c:636",
  "sys/netproto/802_11/wlan/ieee80211_hwmp.c:627",
  "sys/netproto/802_11/wlan/ieee80211_hwmp.c:1241",
  "sys/netproto/802_11/wlan/ieee80211_hwmp.c:1254",
  "sys/netproto/802_11/wlan/ieee80211_hwmp.c:1090",
  "sys/netproto/802_11/wlan/ieee80211_hwmp.c:1521",
  "sys/netproto/802_11/wlan/ieee80211_mesh.c:203",
  "sys/netproto/802_11/wlan/ieee80211_mesh.c:1028"
 ],
 "poc_changes": "Extended the DF-3286 shared fwm.c harness with step 30 (PREQ builder), plus steps 31/32 for the sibling DF-3328 PoC and kern.fwm_ttl. The seed sketch in this finding did not exist; the frame layout was derived from ieee80211_mesh.h IE constants (PREQ=130, len=26+11, TCNT offset 27).",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 420,
 "guest_dirty": 0,
 "build_cmd": "sh findings/poc/DF-3327/build.sh (in-guest: cd /root/fwm && make SYSDIR=/usr/src/sys)",
 "run_cmd": "sh findings/poc/DF-3327/run.sh (sysctl kern.fwm_step=4 then kern.fwm_step=30)",
 "code_hash": "5c225f5fc813a2e5925d1020e5078a829386c450bb53ccb72b70421e942cfbcc",
 "notes": "Impact is a NULL-deref panic (DoS), not memory corruption - no escalation path. Same sink also reachable via PREP propagation (hwmp.c:1558) and intermediate PREP reply (hwmp.c:1303). Requires mesh vap (default MESHFLAGS_AP|FWD, mesh.c:683); CAT_MESH action frames require an ESTABLISHED peer link (ieee80211_action.c:243-256) which the harness auto-establishes. Fix validated on rebuilt kernel #1.",
 "recommended_fix": "NULL-check the find_txnode result in hwmp_send_action and drop the frame (return ENOENT); see fix.diff.",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Thu Sep 10 22:05:55 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "fix.diff applied to guest /usr/src, make -j6 nativekernel (clean), make installkernel, reboot into #1: the same step-30 PREQ fired twice causes no panic (RC=0, guest stays up) and normal PREQ processing/forwarding is preserved (txlog shows the forwarded broadcast PREQ).",
 "fix_evidence": "findings/poc/DF-3327/fix_build.log, findings/poc/DF-3327/fix_run.log"
}