Fix validation -- kernel #2 = stock + fix.diff (no instrumentation)
built in-guest: make nativekernel KERNCONF=X86_64_GENERIC && make installkernel
Guest uname: DragonFly dfbsd 6.5-DEVELOPMENT #2 Fri Sep 11 12:44:59 UTC 2026

Post-fix matrix (same harness, same beacons):

TDMA (expect: short 12-byte TDMA IEs rejected as malformed; the
full-length 22-byte IE with free slots still accepted):

fwscan: ===== TEST 17 START =====   (full 22B TDMA IE, slotcnt=8, inuse=00)
fwscan: scan_end -> 1  (C ACCEPTED)          <- valid IE still works
fwscan: ===== TEST 14 START =====   (12B IE, slotcnt=8, inuse=00; was ACCEPTED)
fwscan: scan_end -> 0  (C REJECTED)          <- short IE now rejected (NOIE)
fwscan: ===== TEST 12 START =====   (12B IE, slotcnt=255, 0x00 groom; was
fwscan: scan_end -> 0  (C REJECTED)             ACCEPTED via the OOB byte)
fwscan: ===== TEST 11 START =====   (12B IE, slotcnt=255, 0xff groom)
fwscan: scan_end -> 0  (C REJECTED)          <- rejected (by NOIE, not OOB)

HTCAP (expect: the phantom-HT selection is gone; A (real 54M) always wins):

fwscan: ===== TEST 1 START =====    (trailing HTCAP len 0, 0xff groom; on the
fwscan: scan_end -> 1                     stock kernel B (5.5M) WON here)
fwscan: post-selection iv_bss mac 02:11:11:11:11:11   <- A WINS NOW
fwscan: ===== TEST 2 START =====
fwscan: post-selection iv_bss mac 02:11:11:11:11:11
fwscan: ===== TEST 3 START =====
fwscan: post-selection iv_bss mac 02:11:11:11:11:11

Baseline vs patched:
- stock kernel:  v1 -> B joined (OOB 0xff bytes fabricated MCS31-HT40);
                 v12 -> accepted via an out-of-bounds slot byte.
- fixed kernel:  v1 -> A joined (correct); v12/14/11 -> rejected as
                 malformed; v17 (valid full IE) -> accepted.
All OOB-dependent behavior eliminated; valid traffic unaffected.