# DF-3594 — bwn_intr_noise re-entry after sample collection completes → 4-byte OOB write past noi_samples into mac_phy (or KASSERT panic)

## Build / Run / Expected

```
# on the DF guest, as root:
sh probe.sh
```

Guest result: driver resident, **no Broadcom hardware** → runtime `inconclusive`.
On a BCM43xx (G-PHY) machine whose firmware raises an extra
`BWN_INTR_NOISESAMPLE_OK` after the 8-sample window closed (spurious/stale
interrupt, or a malicious card), the expected observation:

* INVARIANTS kernels: `panic: kassert "/sys/dev/netif/bwn/bwn/if_bwn.c:5198: fail"`
* non-INVARIANTS kernels: silent 4-byte out-of-bounds write at
  `mac->mac_noise.noi_samples[8][0..3]` — past the `[8][4]` array into
  `struct bwn_phy mac_phy` (`if_bwnvar.h:576-580`, `:917-918`) — corrupting
  `mac_phy.type/rev/analog` with RSSI-LUT bytes influenced by the received
  signal, leading to subsequent misbehavior/panic in PHY dispatch.