From owner-freebsd-stable@FreeBSD.ORG  Wed Feb  2 19:46:13 2005
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A394E16A4CE
	for <freebsd-stable@freebsd.org>;
	Wed,  2 Feb 2005 19:46:13 +0000 (GMT)
Received: from smtp05.web.de (smtp05.web.de [217.72.192.209])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 58C5B43D2D
	for <freebsd-stable@freebsd.org>;
	Wed,  2 Feb 2005 19:46:13 +0000 (GMT)	(envelope-from nakal@web.de)
Received: from [217.225.226.126] (helo=localhost.localdomain)
	by smtp05.web.de with esmtp (TLSv1:RC4-MD5:128)
	(WEB.DE 4.103 #192)
	id 1CwQS4-0007ao-00
	for freebsd-stable@freebsd.org; Wed, 02 Feb 2005 20:46:12 +0100
From: Martin <nakal@web.de>
To: FreeBSD Stable <freebsd-stable@freebsd.org>
Content-Type: text/plain
Date: Wed, 02 Feb 2005 20:46:09 +0100
Message-Id: <1107373569.804.17.camel@klotz.local>
Mime-Version: 1.0
X-Mailer: Evolution 2.0.3 FreeBSD GNOME Team Port 
Content-Transfer-Encoding: 7bit
Sender: nakal@web.de
X-Sender: nakal@web.de
Subject: Remote panic with ath(4)
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2005 19:46:13 -0000


Hi,

there is a way to crash a connected wireless box
running with ath(4) by using another one with an
ath(4) interface in hostap mode.

Steps to reproduce:
# ifconfig ath0 powersavesleep 0
# ping <wireless-client-ip>


The panic is in:
ath_beacon_config()

Problem:
Fatal trap 18: integer divide fault while in kernel mode

on the wireless client uname shows:
FreeBSD 5.3-STABLE FreeBSD 5.3-STABLE #0:
Sat Jan 29 19:30:55 CET 2005 i386

Martin