/*
 * DF-3971 trigger sketch — rt2560 beacon slot overwrite leaks the old
 * beacon mbuf + its ieee80211_node reference on every re-RUN transition
 * =====================================================================
 * rt2560.c:811-824 (rt2560_newstate, nstate == IEEE80211_S_RUN):
 *           m = ieee80211_beacon_alloc(ni);        // brand-new mbuf M2
 *           ...
 *           ieee80211_ref_node(ni);                // +1 ref on new bss N2
 *           error = rt2560_tx_bcn(sc, m, ni);
 *
 * rt2560.c:1516-1547 (rt2560_tx_bcn):
 *           desc = &sc->bcnq.desc[sc->bcnq.cur];
 *           data = &sc->bcnq.data[sc->bcnq.cur];   // slot 0 (COUNT==1)
 *           ...
 *           data->m = m0;                          // overwrites M1
 *           data->ni = ni;                         // overwrites N1 ref
 *
 * Nothing frees the previous occupants of the (single-slot) beacon ring:
 * every re-entry into RUN while the interface stays up leaks one mbuf
 * cluster (~2KB) and one ieee80211_node reference. Re-RUN without a stop
 * is a normal event, remotely pump-able in IBSS mode:
 *
 *   beacon rx -> ieee80211_ibss_merge (ieee80211_node.c:610-637)
 *             -> ieee80211_sta_join1 (ieee80211_node.c:429+)
 *             -> ieee80211_new_state(vap, IEEE80211_S_RUN, -1)   [non-STA]
 *             -> rt2560_newstate(...RUN) -> rt2560_tx_bcn overwrite
 *
 * Any peer on-channel broadcasting an IBSS beacon with the same SSID and a
 * higher TSF forces a merge (the "oldest network wins" rule), so a remote
 * attacker can cycle BSSIDs and leak one beacon mbuf + node ref per cycle.
 * Also on the error path (map-load failure inside tx_bcn, which m_freem()s
 * the m itself) the ref_node taken at rt2560.c:820 is never dropped.
 *
 * On-hardware trigger (needs an RT2560 NIC in adhoc mode; guest has none):
 *   # ifconfig wlan0 create wlandev ral0 wlanmode adhoc ssid leak
 *   # ifconfig wlan0 10.0.0.1/24 up                # first RUN: slot filled
 *   # from a 2nd radio: flood adhoc beacons with rotating BSSIDs and
 *   #   monotonically increasing TSF on the same channel/SSID
 *   # -> each merge leaks; watch `netstat -m` / node count climb.
 */
#include <stdio.h>
int main(void) {
    printf("hardware-gated: see header comment for the on-target recipe\n");
    return 0;
}