CVE-2022-23088-6.c

// ‘ies’ can be overflown into, so we can fully control its contents
int
ieee80211_ies_init(struct ieee80211_ies *ies, const uint8_t *data, int len)
{
    memset(ies, 0, offsetof(struct ieee80211_ies, data));
$0	if (ies->data != NULL && ies->len != len) { // <-- Ayy, we control these two fields
    IEEE80211_FREE(ies->data, M_80211_NODE_IE);
    ies->data = NULL;
    }
    if (ies->data == NULL) {
        ies->data = (uint8_t *) IEEE80211_MALLOC(len, M_80211_NODE_IE,
            IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
        if (ies->data == NULL) {
            ies->len = 0;
            return 0;
        }
    }
$1	memcpy(ies->data, data, len); // <-- I believe in miracles
    ies->len = len;
    return 1;
}