# DF-3343 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
ieee80211_media_setup indexes ieee80211_htrates[77] with ic_txstream*8-1 and no clamp; a driver/HAL value of 20 reads entry 159 (82 entries past the const table). Driver-gated (stock drivers program 1..4); verbatim harness with the real table shape faults the guard page.

## Build
```
./build.sh
```

## Run
```
df3343 oob
```
(success criterion: see VERDICT.md)

## Evidence
control (txstream=4 -> index 31) rc=0; txstream=20 -> index 159 rc=139; FIXED clamp clean

Kernel references: sys/netproto/802_11/wlan/ieee80211.c:1620-1629, sys/netproto/802_11/_ieee80211.h:388