# DF-3329 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
verify_mesh_preq_len/verify_mesh_perr_len read iefrm[2]/iefrm[27|33]/iefrm[3] and walk PERR destinations BEFORE and BEYOND the declared IE length (three OOB cases). Verbatim harness faults the guard page on all three.

## Build
```
./build.sh
```

## Run
```
df3329 1
```
(success criterion: see VERDICT.md)

## Evidence
cases 1-3 rc=139 (preq iefrm[33]; perr iefrm[3]; perr dest-flag walk); control (full IE) rc=0; FIXED bound clean

Kernel references: sys/netproto/802_11/wlan/ieee80211_hwmp.c:317-386, sys/netproto/802_11/ieee80211_mesh.h:229-285