DF-3285

ieee80211_beacon_update writes the Quiet IE in place at bo_quiet even when no Quiet IE was constructed - corrupts the beacon IE chain in-bounds (malformed beacons on air)

Summary

beacon_construct records bo->bo_quiet=frm and only writes a Quiet IE if iv_quiet was set at construct time; beacon_update unconditionally writes an 8-byte Quiet IE at bo_quiet on every TBTT once iv_quiet is enabled on a DFS channel. If quiet was enabled after the beacon was built, the write lands on the first bytes of the ERP/xrates/RSN region - in-bounds of the reserved mbuf space (no memory-safety violation), but the transmitted beacon's IE chain becomes malformed (clobbered element id/length bytes), degrading/DoSing client association on 11h DFS networks. Frame-integrity/interop defect; privileged config change. Fix: track Quiet-IE presence like CSA or rebuild the beacon on iv_quiet transitions. [VERIFIED pass2: unconditional in-place Quiet-IE write when none constructed confirmed needs DFS radio; bo_quiet_set tracking fix compiled]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — network stack
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE: CWE-682
File: sys/netproto/802_11/wlan/ieee80211_output.c
Lines: 3172-3576
Area: net
Discovered: 2026-09-10
Updated: 2026-09-10

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:04
Attempts: 0
Runtime: 30s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:04
Runtime: —
Kernel: per-fix-DF-3285
fix.diff: findings/poc/DF-3285/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3285 · 4 files

File	Type	Size
README.md	—	249 B	↓ raw
fix.diff	—	1.4 KB	view raw
manifest.json	—	392 B	view raw
verdict.json	—	1.7 KB	view raw

README.md

↓ download raw

DF-3285 evidence pack

What

beacon_update writes the Quiet IE at bo_quiet even when none was constructed

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

fix.diff applied in the F40FIX verification kernel build (RC=0, zero -Werror errors); no runtime A/B for this item (line-certain hardening)

↓ fix.diffper-fix-DF-3285

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - no 802.11 radio on this guest

Verified recommended fix

track Quiet-IE construction (bo_quiet_set); update only in place when built

Verdict

Line-accurate confirmation; runtime demonstration not possible on this guest (requires an 11h DFS-capable AP VAP with quiet enabled after beacon construction; QEMU has no 802.11 radio). beacon_construct records bo->bo_quiet=frm and only writes an 8-byte Quiet IE when iv_quiet was set at construct time (ieee80211_output.c:3173-3180); beacon_update unconditionally calls ieee80211_add_quiet(bo->bo_quiet, vap) once iv_quiet is enabled (:3574-3575) - an in-bounds write over the first bytes of the ERP/xrates/RSN region that corrupts the transmitted beacon IE chain. Fix tracks Quiet-IE presence (bo_quiet_set) and skips the update write when absent; compiled in the F40FIX build (wlan in kernel).