DF-3288 — ms_known_gates gate entries are never freed: unauthenticated GANN spam grows kernel heap without bound and leaks across vap destroy

File: sys/netproto/802_11/wlan/ieee80211_mesh.c (pass 2 audit)

What

Every accepted GANN action frame from a new gate address allocates a struct ieee80211_mesh_gate_route (:2662-2676) and links it into ms->ms_known_gates:

if (found == 0) {
        gr = kmalloc(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
            M_80211_MESH_GT_RT, M_INTWAIT | M_ZERO);
        IEEE80211_ADDR_COPY(gr->gr_addr, ie.gann_addr);
        TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
}

ms_known_gates has no removal path anywhere in sys/ (only INSERT_TAIL at :907 and :2675; verified by grep), no aging, and mesh_vdetach (:646-659) frees vap->iv_mesh without walking the gate list. Consequences:

1. any mesh peer (established = one beacon + 2 action frames) injects GANNs with fresh gann_addr values → one ~40-byte kmalloc each, forever — unauthenticated remote kernel memory exhaustion;
2. destroying the mesh vap leaks the whole table — the entries outlive the vap; recreate/destroy cycles accumulate.

(Note: DF-0289 already covers the gr_route dangling-pointer aspect of the gate table; this finding is the missing free / unbounded growth, a different defect at different lines.)

Reproduced (stock kernel, vmstat -m)

# after 500 injected GANNs (sysctl kern.fwm_count=500; kern.fwm_step=20)
80211mesh_gt     503   19.6K       0    390M      503
# after `ifconfig wlan0 destroy`
after vap destroy:
80211mesh_gt     503   19.6K       0    390M      503      <-- LEAKED
# recreate vap, 100 more GANNs, destroy again:
80211mesh_gt     603   23.6K       0    390M      603
80211mesh_gt     603   23.6K       0    390M      603      <-- accumulates forever

Meanwhile 80211mesh_rt returns to 0 on destroy — only the gate table leaks.

Build / run

sh findings/poc/DF-3286/build.sh    # shared harness
sh findings/poc/DF-3288/run.sh      # 500 GANNs, destroy, vmstat -m

Threat

Remote unauthenticated (post-peering) kernel heap exhaustion; ~40 bytes per 19-byte action frame, no ceiling, permanent across vap churn. CWE-401. Severity Medium.