mt76 StaNss Underflow

Vulnerability analysis

When a WiFi peer advertises a VHT or HE MCS map indicating no supported spatial streams (all fields set to the unsupported value), the driver's spatial-stream detection loop exits without finding any valid entry, leaving the stream counter at zero. The function then subtracts one from this zero value, which wraps to 255 when stored as an unsigned byte, and this bogus value is passed into firmware beamforming configuration fields. The fix checks for the zero case and clamps the result to zero instead of allowing the underflow. The vulnerable code path is reached whenever the MT7915 driver processes a peer station's capability information, so any WiFi device within radio range that can send management or association frames to the affected host can trigger it — no authentication, local access, or special privileges are needed, though the specific MediaTek MT7915 hardware and driver must be present.