DF-3404 — ieee80211_parse_beacon VENDOR branch stores pre-draft HT-info IE into scan->htcap (copy-paste typo)

What

sys/netproto/802_11/wlan/ieee80211_input.c:644-656:

} else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
        if (ishtcapoui(frm)) {
                if (scan->htcap == NULL)
                        scan->htcap = frm;
        } else if (ishtinfooui(frm)) {
                if (scan->htinfo == NULL)
                        scan->htcap = frm;      /* <-- TYPO: should be scan->htinfo */
        }
}

The ishtinfooui branch assigns to scan->htcap instead of scan->htinfo (the guard even tests scan->htinfo, proving the intent). This is the lead noted in the pass-2 task_log from the ieee80211_scan_sta audit; verified present in this tree.

Consequences (characterized):

1. Pre-draft/vendor HT networks lose HT entirely (feature DoS). A beacon carrying a Broadcom-OUI HTINFO vendor IE (and no standard HTINFO, id 61) leaves scan->htinfo == NULL; every consumer gates on htcap != NULL && htinfo != NULL (ieee80211_sta.c:1397-1404, :1701-1705: ieee80211_ht_updateparams/ieee80211_setup_htrates never run) — the STA associates without 802.11n. Remote, unauthenticated (beacon-driven), but only degrades throughput/feature, no memory unsafety.

2. Mis-typed IE feeds HT negotiation. If a standard HTINFO (id 61) is also present, scan->htcap ends up pointing at the htinfo vendor IE. The post-loop gate (:733-738) then demands the vendor-HTCAP length (≥ 4+26 = 30) of it, so a padded vendor htinfo IE passes and consumers parse HT-info bytes (MCS/rate fields at htcap offsets) as HT capabilities — corrupt HT capability negotiation (sta.c:1398-1404 / :1704-1713). No OOB: the ≥30-byte length check bounds every later fixed-offset read, and consumers re-derive from the same IE.

If the vendor htinfo IE is its natural length (26), the :733 check nulls scan->htcap — both HT IEs lost (same DoS as (1)).

3. Vendor HTCAP IE silently dropped whenever a vendor HTINFO was seen first (if (scan->htcap == NULL) guard fails) — real capabilities lost.

FreeBSD fixed this same typo in wlan (r209365-era "fix HT IE parsing copy/paste bug"); the DFly tree retains it.

Impact

Low / certain (typo proven; effects characterized above: remote feature-level DoS of pre-draft HT + mis-typed IE into HT negotiation; no memory unsafety). Phase V skipped (Low, logic bug — per contract).

Fix

        } else if (ishtinfooui(frm)) {
            if (scan->htinfo == NULL)
-               scan->htcap = frm;
+               scan->htinfo = frm;
        }