| TEST-SSID does accept this client – intermittently, with the stock frame |
finding |
device:google-taimen |
proven |
| TEST-SSID refuses this client, and our association request is not the reason |
finding |
device:google-taimen |
proven |
| ath10k turns off mac80211’s idle connection polling, then disables the firmware keepalive too |
finding |
generic |
proven |
| taimen invents a new WLAN MAC every boot – and it is not rmtfs, not caldata, and not a rate mismatch |
finding |
device:google-taimen |
proven |
| The missing 4-way handshake is ath10k’s rx_confused latch: one split A-MSDU disables data RX for the life of the firmware |
finding |
device:google-taimen |
proven |
| The monitor vif was never deaf – the radiotap parser was, and the phone is LOUD |
finding |
device:google-taimen |
proven |
| The reserved VHT channel-width pair was the refusal – clamping it associates 8/8 |
finding |
soc:msm8998 |
proven |
| Two thirds of successful associations never complete the 4-way handshake, and ath10k says nothing |
finding |
device:google-taimen |
proven |
| wpa_supplicant’s vht_capa cannot change Supported Channel Width Set or Extended NSS BW – mac80211 drops it |
finding |
generic |
proven |
| Playbook: wifi, bluetooth and modem |
technique |
generic |
proven |
| Playbook: NFC |
technique |
generic |
proven |
| A monitor vif on ath10k can be added alongside managed but receives nothing |
trap |
soc:msm8998 |
proven |
