# DF-3364 — `tdma_isfull()`/`match_bss()` heap OOB read via unvalidated `tdma_ie` slot count

File: `sys/netproto/802_11/wlan/ieee80211_scan_sta.c` (pass 2)

## What

`ieee80211_ies_expand()` exposes `se_ies.tdma_ie` for **any** vendor IE
carrying the TDMA OUI — `istdmaoui()` only requires `ie[1] > 3`
(ieee80211_input.h:118-121). `match_bss()`'s AHDEMO+TDMA branch
(ieee80211_scan_sta.c:1016-1028) then reads `tdma_version` (IE offset
7), `tdma_slot` (8), `tdma_slotcnt` (9) and calls `tdma_isfull()`
(:959-969), which scans `isclr(tdma->tdma_inuse, slot)` for slot down
from the **attacker-controlled** `slotcnt-1` although `tdma_inuse[]`
is 1 byte (8 slots) and the whole IE may be as short as 6 bytes.

With `slotcnt = 255` the reads reach `tdma_inuse[31]` = IE byte 44 =
up to **30 bytes past the end of the exactly-sized blob allocation**
when the TDMA IE is the blob's last IE. `tdma->tdma_version` (offset
7) is already past a minimal OUI-only IE.

## Reproduced (instrumented kernel #1 — stock logic + kprintf probes only)

AHDEMO+TDMA vap (`ifconfig wlan create wlandev fws0 wlanmode tdma up`;
TDMA + MESH are compiled into X86_64_GENERIC, sys/config/X86_64_GENERIC:257).
Beacon C: TDMA master (slot 0, version 2 == vap's), `inuse[0]=0xff`
(all 8 legal slots busy), `slotcnt=255`, TDMA IE last in a 64-byte blob:

- groom 0x00 past the allocation: kernel `tdma_isfull` printed
  `inuse[31]=00` → `clear at slot 254 (byte +44)` → `fail=0x0` →
  **C ACCEPTED** — the acceptance came from an out-of-bounds byte.
- groom 0xff: `inuse[31]=ff` → `FULL` → `fail=0x1000`
  (MATCH_TDMA_NOSLOT) → **C REJECTED**.
- control slotcnt=8: decision from in-bounds bytes only.

GCC itself corroborates the class: instrumenting the read as
`tdma_inuse[31]` trips `-Werror=array-bounds` ("array subscript 31 is
above array bounds of `const u_int8_t[1]`").

## Threat

Requires an AHDEMO+TDMA vap (root-created, TDMA-capable driver) —
config-dependent reachability, but unauthenticated beacon input.
Impact: heap OOB read ≤ ~30 bytes whose value flips candidate
acceptance (same oracle grade as DF-3363).

## Build / run

Same harness as DF-3363 (`fwscan.ko`): `sysctl kern.fwscan_test=11|12|14|17`
with the tdma vap. Fix validated together with DF-3363 (see
`../DF-3363/fix_validation.log`): post-fix all short TDMA IEs are
rejected (NOIE), a full-length valid TDMA IE (test 17) is accepted.