This is a protocol-boundary validation failure, not merely an arithmetic bug. The llsec_do_decrypt_auth() function in the mac802154 stack performs unsigned arithmetic on the authenticated-data length field, assuming the incoming frame is always longer than its authentication tag. IEEE 802.15.4 framing provides no such guarantee. The result is a crypto_aead_decrypt() call instructed to walk past the actual frame data into kernel memory, reading and decrypting uninitialized heap content.
What makes this severe is the downstream impact. The AEAD primitive doesn't just leak memory—it authenticates and decrypts whatever uninitialized bytes it finds, producing output the kernel then acts on. In industrial IoT, smart grid, and medical implant contexts where 802.15.4 operates, this means authorization decisions can be poisoned with attacker-controllable heap state. The 'attacker in radio range' qualifier is a misnomer for these deployments: maintenance personnel, neighboring equipment, and anyone with line-of-sight to a smart meter or implant radio is within exploitation range.
The deeper failure is ownership. No layer in the mac802154 stack validates frame length before cryptographic processing. The MAC layer assumes llsec handles it. llsec assumes frames arrive pre-validated. The kernel crypto AEAD API itself accepts assoclen as an unsigned parameter with zero internal bounds checking against the actual scatterlist—this creates a cognitive trap where the function signature provides no signal that catastrophic failure is possible on certain inputs.
Check your deployments for mac802154-enabled kernels. The fix is a one-liner guard rejecting frames shorter than their authentication tag, but the pattern is likely present elsewhere: any kernel crypto path that performs arithmetic on attacker-controlled length fields without explicit preconditions is vulnerable. Audit llsec entry points and adjacent wireless drivers for similar unsigned subtraction assumptions, particularly where protocol framing and cryptographic processing intersect.