Cross-reference: Same overflow class as DF-0618 (ieee80211_wds.c dwds_discover age). Both use (ni_intval * ic_lintval) << 2 in signed int.

Summary

ieee80211_pwrsave computes each buffered frame's expiry age as IEEE80211_TU_TO_MS((ni->ni_intval * ic->ic_bintval) << 2) / 1000 in signed int. ni->ni_intval is taken verbatim from the peer's association-request listen interval (hostap.c:1978, set at :2130 with no validation) and ic->ic_bintval is uint16_t, so for moderate intval bands the multiply-by-1024 (inside IEEE80211_TU_TO_MS) overflows. The resulting negative age trips KASSERT(age >= 0) at line 397 on INVARIANTS kernels (remote system-wide panic); on production kernels it is undefined behavior that corrupts the per-node PSQ aging deltas.

Root cause

Line 360: age = IEEE80211_TU_TO_MS((ni->ni_intval * ic->ic_bintval) << 2) / 1000; with IEEE80211_TU_TO_MS(x)=((x)*1024)/1000 (ieee80211_var.h:88).

Both operands are uint16_t promoted to int. Worked example with default bintval=100 and intval=8000: 8000*100=800000, <<2=3200000, *1024=3,276,800,000 which as int32 is -1,018,167,296 (signed overflow), /1000 = -1,018,167. The negative age hits KASSERT(age >= 0) at line 397.

The developer flagged this themselves with /* XXX handle overflow? */ at line 359. ni->ni_intval is set verbatim from the peer's listen interval (ieee80211_hostap.c:1978,2130 with no range validation).

Threat model & preconditions

• Attacker: any wireless peer that can associate to a DragonFlyBSD HOSTAP-mode vap (open auth suffices). Sends a listen interval in an overflow band, transitions to power-save, causes AP to buffer a frame.
• Impact on INVARIANTS kernels: KASSERT(age>=0) fires → kernel panic → system-wide DoS.
• Impact on production kernels: no panic; the negative age causes the frame to be discarded immediately — a self-inflicted DoS (the malicious peer only starves its own buffered traffic).
• No memory-corruption/privilege-escalation path.

Recommended fix

Do the TU→seconds math in 64-bit and clamp:

--- a/sys/netproto/802_11/wlan/ieee80211_power.c
+++ b/sys/netproto/802_11/wlan/ieee80211_power.c
@@ -356,8 +356,16 @@
-   /* TU -> secs.  XXX handle overflow? */
-   age = IEEE80211_TU_TO_MS((ni->ni_intval * ic->ic_bintval) << 2) / 1000;
+   /* TU -> secs. */
+   {
+       uint64_t ms = IEEE80211_TU_TO_MS(
+           ((uint64_t)ni->ni_intval * ic->ic_bintval) << 2) / 1000;
+       age = ms > (uint64_t)INT_MAX ? INT_MAX : (int)ms;
+   }

References

• sys/netproto/802_11/wlan/ieee80211_power.c:359-360 — the overflow.
• sys/netproto/802_11/wlan/ieee80211_power.c:397 — the KASSERT(age>=0).
• sys/netproto/802_11/wlan/ieee80211_hostap.c:1978,2130 — unvalidated listen interval.
• DF-0618 — the same-class overflow in ieee80211_wds.c.

Timeline

• 2026-07-02 Discovered during automated DragonFlyBSD kernel security audit.
• 2026-07-02 Reported to DragonFlyBSD security contact (pending).