# DF-3455 -- verification pack

**Method:** Verbatim-interposition harness (guard-page technique; no wlan/sppp hardware on this guest)
**Status:** REPRODUCED | impact: denial_of_service | confidence: certain

## What this is
NOL/CAC timeout arithmetic overflows before the wrap-aware compare: root sysctl net.wlan.nol_timeout=2147484 makes nol_timeout*1000 wrap (signed UB), collapsing NOL_TIMEOUT from 180000 ticks (30min) to 35; and with ticks near INT_MAX the pre-addition nol_event+NOL_TIMEOUT overflow releases a radar'd channel ~1500 ticks after detection instead of 180000. Pure-arithmetic harness over the verbatim macros (wlan absent on guest).

## Build
```
./build.sh
```

## Run
```
(no arg)
```
(success criterion: see VERDICT.md)

## Evidence
misc3.log DF-3455: [b] NOL_TIMEOUT=35 ticks; [c] released after ~1500 ticks (expected 180000)

Kernel references: sys/netproto/802_11/wlan/ieee80211_dfs.c:57-63, sys/netproto/802_11/wlan/ieee80211_dfs.c:244-247, sys/netproto/802_11/wlan/ieee80211_dfs.c:268, sys/netproto/802_11/ieee80211_dragonfly.h:130