Summary

Both registration helpers check only 'act >= nitems(table)' before writing table[act] = f - a negative int act passes and writes a function pointer below the table. The dispatch side guards only 'act < nitems(table)' so a negative act reads a function pointer from below the table and tail-calls it. On-air frames cannot supply negative values (ia_action uint8_t and bounded), every in-tree caller passes small non-negative constants - a kernel-internal API contract hazard, not reachable today: one future caller forwarding user/ioctl-influenced act turns the register path into a controlled-index kernel OOB write and the send path into an OOB indirect call. Fix: reject negative act in both register helpers and the send dispatch. [VERIFIED pass2: one-sided act bounds confirmed at all sites; negative act unreachable uint8 constants; two-sided checks compiled]