>> building harness (buggy): cc  -Wall -O2 -o df3459_harness df3459_harness.c
>> built df3459_harness (rc=0)
layout: ra_pktrate@48  ra_rate_thresh@52  (thresh[-1] aliases offset 50 = ra_pktrate+2)
rssi=0 fresh node : rssadapt_rate -> rix=-1  ra_rix=-1  ni_txrate=0x08 (bogus: rs_nrates byte 8)
  -> rs_rates[-1] read returned the rs_nrates byte (1): in-struct OOB read confirmed
  -> iwm_setrates KASSERT(rix >= 0 && rix < nrates): VIOLATED  (INVARIANTS kernel would PANIC here)
lower_rate with ra_rix=-1: u_int rix = 0xffffffff -> access at chunk+0x200000032 (wild +7 GiB)
  -> WILD ACCESS confirmed: kernel equivalent is a ~+8GiB READ+WRITE from the rssadapt_node chunk -> kernel page fault -> PANIC
after tx-complete failure: ra_pktrate = 0x11223344 (was 0x11223344)  canaries intact
RESULT: BUG REPRODUCED — rix=-1: in-struct rs_rates[-1] read, iwm KASSERT violation, and u_int-indexed ~+8GiB wild read+write in rssadapt_lower_rate()
rc=0