Out-of-bounds read via undersized MLME frames

Out-of-bounds read in the cfg80211 MLME path in Linux allows attackers to read two bytes beyond an undersized management frame. The receive and transmit callbacks dispatch frames after checking only the two-byte frame-control field, while subtype handlers access fixed authentication, deauthentication, or disassociation fields beyond that boundary. Reachability requires a wireless driver to pass a subtype-short frame into the callback; the published evidence establishes the two-byte read but no crash, disclosure path, or code execution.