# DF-3341 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
parse_beaon TIM IE stored without length verification (input.c:586-589); scan_sta consumer reads tim->tim_period (byte 4) - a TIM IE with declared len < 3 drives the read past the IE end into stale mbuf bytes (DTIM cache). Verbatim chain harness faults the guard page.

## Build
```
./build.sh
```

## Run
```
df3341 oob
```
(success criterion: see VERDICT.md)

## Evidence
control (len=5) rc=0; len=1 TIM IE rc=139; FIXED length check clean

Kernel references: sys/netproto/802_11/wlan/ieee80211_input.c:586-589, sys/netproto/802_11/wlan/ieee80211_scan_sta.c:348-351, sys/netproto/802_11/ieee80211.h:952-956