# DF-3580 — Inverted privilege-check result in iwn_cdev_ioctl()

## Root cause (source-verified)

`sys/dev/netif/iwn/if_iwn.c:5157-5160`:

```c
rc = caps_priv_check((td ? td->td_ucred : NULL),
                     SYSCAP_NODRIVER | __SYSCAP_NULLCRED);
if (rc != 0)
        return (0);          /* <-- returns SUCCESS on privilege FAILURE */
```

When the caller **lacks** the privilege (`rc != 0`) the ioctl returns 0
(success) while doing nothing; when the caller **has** the privilege the
command executes. The intended code is `return (rc);` (or EPERM). This is a
long-standing typo inherited from FreeBSD's if_iwn.c (`priv_check` +
`return (0)`).

Additionally, the SIOCGIWNSTATS handler (if_iwn.c:5162-5169) trusts the
user-supplied `struct iwn_ioctl_data { void *dst_addr; int dst_len; }`
without touching `dst_len` — the copyout length is fixed
(`sizeof(struct iwn_stats)`), so no overflow arises, but the in-code
"XXX validate permissions/memory/etc?" comment (if_iwn.c:5166) is accurate.

## Impact

None demonstrated. The device node is created 0600 root:wheel
(if_iwn.c:776-777), and the buggy early-return is fail-*closed* in effect
(unprivileged callers get errno 0 but no data — an errno-correctness bug,
not an exposure). Filing as Info/hardening: inverted security-check results
are exactly the kind of line a future refactor turns into a real bypass
(e.g. if someone "fixes" the return into `goto out` semantics or reuses the
pattern elsewhere).

## Status

**untested** — behavior is a two-line logic inversion; the cdev exists only
with iwn hardware attached, which the audit guest lacks. Source-certain.

## Fix

```diff
-	if (rc != 0)
-		return (0);
+	if (rc != 0)
+		return (rc);
```