oh good catch, I thought I had found all of these!

ugh ok why's do_ht being set when there's no htcap/htinfo fields.

OH, hilarious, it's because you have VHT parameters but not HT parameters? That's problematic. Would you mind doing an "ifconfig -v wlan0 list scan" to capture what's being seen in the scan, find the entry that has VHT parameters and not HT parameters, and including it in here?

Since it is also part of the VHT code path we can't just /not/ do it here; I think we need to handle NULL IE pointers in ieee80211_ht_updateparams_final() and just not do the htinfo deferefence there. (And document that the function must handle NULL IEs.)

Would you like to try that instead?

In D58020#1330655, @adrian wrote:

ugh ok why's do_ht being set when there's no htcap/htinfo fields.

OH, hilarious, it's because you have VHT parameters but not HT parameters? That's problematic. Would you mind doing an "ifconfig -v wlan0 list scan" to capture what's being seen in the scan, find the entry that has VHT parameters and not HT parameters, and including it in here?

Yes, first first gather data before any further conclusions; and see if it is a broken AP.

Since it is also part of the VHT code path we can't just /not/ do it here; I think we need to handle NULL IE pointers in ieee80211_ht_updateparams_final() and just not do the htinfo deferefence there. (And document that the function must handle NULL IEs.)

I have a partly done entire rework of IE handling in net80211 as we do have multiple places (regularly reported in the last years) without proper checks one way or another.

@adrian It's a (pretty terrible) AP from Huawei

Alpine_5G_2
18:70:3b:01:2c:40  149   54M  -73:-96   100 EPS
SSID<Alpine_5G_2>
RATES<B12,18,B24,36,B48,72,96,108>
DSPARMS<149>
PWRCNSTR<200100>
TPCREP<23021e00>
RRM_ENCAPS<46057200000000>
RSN<v1 mc:AES-CCMP uc:AES-CCMP km:8021X-PSK>
WME<
	qosinfo 0x80
	BE[aifsn 3 cwmin 4 cwmax 10 txop 0]
	BK[aifsn 7 cwmin 4 cwmax 10 txop 0]
	VO[aifsn 2 cwmin 3 cwmax 4 txop 94]
	VI[aifsn 2 cwmin 2 cwmax 3 txop 47]>
BSSLOAD<sta count 1, chan load 5, aac 0>
HTCAP<cap 0x1ef param 0x17 mcsset[0-15] extcap 0x0 txbf 0x0 antenna 0x0>
HTINFO<ctl 149, 5,15,0,0 basicmcs[]>
EXTCAP<7f080000080000000040>
VHTCAP<cap 0x028109b1 rx_mcs_map 0xfffa rx_highest 866 tx_mcs_map 0xfffa tx_highest 866>
VHTOPMODE<chw 1 freq0_idx 155 freq1_idx 0 basic_mcs_set 0xfffa>
VEN<dd08ac853d8201000000>
WPS<
	v:1.0
	state:C
	resp_type:0x03
	uuid-e:df-64-14-3a-c7-99-52-dd-9a-2b-71-5d-62-34-6f-ec 
	manufacturer:<Huawei Technology Co.,Ltd>
	model_name:<Wireless AP> 
	model_number:<123> 
	serial_number:<12345> 
	prim_dev:00060050f2040001 
	device_name:<WS5800-10> 
	cfg_mthd:virtual_push_button,label, 
	rf:5Ghz, 
	vendor:00372a000120>
VEN<dd0f00e0fc80000000010018703b012c40>
VEN<dd0f00e0fc400000000100fd04a10000a1>

Since it is also part of the VHT code path we can't just /not/ do it here; I think we need to handle NULL IE pointers in ieee80211_ht_updateparams_final() and just not do the htinfo deferefence there. (And document that the function must handle NULL IEs.)
Would you like to try that instead?

Makes sense; I'll try when I have time.

Anyone else interested feel free to take it up in the meantime; I might need some time as I'm messing about with capsicum