# DF-3404 — ieee80211_parse_beacon VENDOR branch stores pre-draft HT-info IE into scan->htcap (copy-paste typo)

## What

`sys/netproto/802_11/wlan/ieee80211_input.c:644-656`:

```c
} else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
        if (ishtcapoui(frm)) {
                if (scan->htcap == NULL)
                        scan->htcap = frm;
        } else if (ishtinfooui(frm)) {
                if (scan->htinfo == NULL)
                        scan->htcap = frm;      /* <-- TYPO: should be scan->htinfo */
        }
}
```

The `ishtinfooui` branch assigns to `scan->htcap` instead of
`scan->htinfo` (the guard even tests `scan->htinfo`, proving the
intent). This is the lead noted in the pass-2 task_log from the
ieee80211_scan_sta audit; verified present in this tree.

Consequences (characterized):

1. **Pre-draft/vendor HT networks lose HT entirely (feature DoS).**
   A beacon carrying a Broadcom-OUI HTINFO vendor IE (and no standard
   HTINFO, id 61) leaves `scan->htinfo == NULL`; every consumer gates
   on `htcap != NULL && htinfo != NULL`
   (`ieee80211_sta.c:1397-1404`, `:1701-1705`:
   `ieee80211_ht_updateparams`/`ieee80211_setup_htrates` never run) —
   the STA associates without 802.11n. Remote, unauthenticated
   (beacon-driven), but only degrades throughput/feature, no memory
   unsafety.

2. **Mis-typed IE feeds HT negotiation.** If a standard HTINFO (id 61)
   is also present, `scan->htcap` ends up pointing at the *htinfo*
   vendor IE. The post-loop gate (`:733-738`) then demands the
   vendor-HTCAP length (≥ 4+26 = 30) of it, so a padded vendor htinfo
   IE passes and consumers parse HT-info bytes (MCS/rate fields at
   htcap offsets) as HT capabilities — corrupt HT capability
   negotiation (`sta.c:1398-1404` / `:1704-1713`). No OOB: the ≥30-byte
   length check bounds every later fixed-offset read, and consumers
   re-derive from the same IE.

   If the vendor htinfo IE is its natural length (26), the `:733`
   check nulls `scan->htcap` — both HT IEs lost (same DoS as (1)).

3. Vendor HTCAP IE silently dropped whenever a vendor HTINFO was seen
   first (`if (scan->htcap == NULL)` guard fails) — real capabilities
   lost.

FreeBSD fixed this same typo in wlan (r209365-era "fix HT IE parsing
copy/paste bug"); the DFly tree retains it.

## Impact

Low / certain (typo proven; effects characterized above: remote
feature-level DoS of pre-draft HT + mis-typed IE into HT negotiation;
no memory unsafety). Phase V skipped (Low, logic bug — per contract).

## Fix

```diff
 		} else if (ishtinfooui(frm)) {
 			if (scan->htinfo == NULL)
-				scan->htcap = frm;
+				scan->htinfo = frm;
 		}
```