# DF-3374 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
ieee80211_parse_csaparams consumes csa_mode/csa_newchan/csa_count with no frm[1] validation (caller passes scan.csa straight from the beacon walk). Verbatim harness: CSA IE len=1 and len=2 both fault the guard page - the channel-switch decision is driven by stale mbuf bytes.

## Build
```
./build.sh
```

## Run
```
df3374 1
```
(success criterion: see VERDICT.md)

## Evidence
cases 1,2 rc=139; control (len=3) rc=0; FIXED length check clean

Kernel references: sys/netproto/802_11/wlan/ieee80211_sta.c:1146-1200, sys/netproto/802_11/wlan/ieee80211_sta.c:1472, sys/netproto/802_11/ieee80211.h:1063-1069, sys/netproto/802_11/wlan/ieee80211_input.c:565