{
  "finding_id": "DF-4882",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reachable-assertion panic, proven statically end-to-end but not exercisable on this guest (no Atheros NIC, no onoe module). DragonFlys default kernel config ships INVARIANTS (verified at /usr/src/sys/config/X86_64_GENERIC:56 in the running guest), so onoe.c:285 KASSERT is an active panic: an unauthenticated IBSS beacon with a zero-length Supported Rates IE reaches ic_newassoc(ni,1) with rs_nrates==0 because ieee80211_parse_beacon accepts zero-length RATES elements (ieee80211_input.h:31-41 checks ie[1] > maxlen only) and ieee80211_init_neighbor ignores the ieee80211_setup_rates error return (ieee80211_node.c:1559-1561, ieee80211_proto.c:746-748). The codes own comment (onoe.c:316-320) documents that rate-less adhoc nodes reach this path and claims it is not fatal - on INVARIANTS kernels it is. Remote DoS for ath+onoe+IBSS configurations.",
  "exploit_chain": "unauthenticated radio peer -> beacon/probe-resp with IBSS capinfo + zero-length RATES IE -> adhoc_recv_mgmt (ieee80211_adhoc.c:735) -> ieee80211_add_neighbor -> ic_newassoc(ni,1) (ieee80211_node.c:1607) -> ath_rate_newassoc isnew (onoe.c:187-190) -> ath_rate_ctl_start -> KASSERT panic (onoe.c:285). Cannot be chained further: it is a clean panic.",
  "evidence": "README.md (full hop-by-hop chain with path:line), VERDICT.md (environment facts), env.txt (guest: INVARIANTS at X86_64_GENERIC:56, pciconf shows no 168c device, /boot/kernel has no onoe module). Decisive lines: onoe.c:285 KASSERT; ieee80211_node.c:1607-1608 unconditional ic_newassoc; ieee80211_proto.c:746-748 okrate==0 error path ignored.",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_rate/onoe/onoe.c:285",
    "sys/netproto/802_11/wlan/ieee80211_adhoc.c:735",
    "sys/netproto/802_11/wlan/ieee80211_node.c:1559",
    "sys/netproto/802_11/wlan/ieee80211_node.c:1607",
    "sys/netproto/802_11/wlan/ieee80211_proto.c:746",
    "sys/netproto/802_11/ieee80211_input.h:31",
    "sys/dev/netif/ath/ath/if_ath.c:1271",
    "sys/config/X86_64_GENERIC:56"
  ],
  "poc_changes": "n/a - no runnable PoC possible without ath hardware; evidence pack documents the static chain and guest environment instead",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored (KASSERT -> graceful return for rs_nrates==0, matching the codes own not fatal comment) but not kernel-buildable-testable here: the panic path needs an ath NIC in IBSS mode with onoe attached, which the guest cannot provide.",
  "fix_evidence": "findings/poc/DF-4882/fix.diff",
  "notes": "amrr.c:312 carries the identical KASSERT (sibling instance, out of this files scope - flagged for the amrr files row). Zero-length (not missing) RATES IE is required: a missing element is flagged IEEE80211_BPARSE_RATES_INVALID and dropped by adhoc_recv_mgmts status check; a zero-length element passes IEEE80211_VERIFY_ELEMENT untouched.",
  "recommended_fix": "Replace onoe.c:285 KASSERT with an early return when rs_nrates==0 (the path ath_rate_update already handles gracefully), and mirror in amrr.c:312",
  "build_cmd": "n/a (no hardware)",
  "run_cmd": "n/a (no hardware)",
  "code_hash": ""
}