37 	char channels[200], *pos, *end;  in mbo_ap_parse_non_pref_chan()  local
63 	pos = channels;  in mbo_ap_parse_non_pref_chan()
64 	end = pos + sizeof(channels);  in mbo_ap_parse_non_pref_chan()
65 	*pos = '\0';  in mbo_ap_parse_non_pref_chan()
67 		ret = os_snprintf(pos, end - pos, "%s%u",  in mbo_ap_parse_non_pref_chan()
69 		if (os_snprintf_error(end - pos, ret)) {  in mbo_ap_parse_non_pref_chan()
70 			*pos = '\0';  in mbo_ap_parse_non_pref_chan()
73 		pos += ret;  in mbo_ap_parse_non_pref_chan()
86 	const u8 *pos, *attr, *end;  in mbo_ap_check_sta_assoc()  local
92 	pos = elems->mbo + 4;  in mbo_ap_check_sta_assoc()
94 	wpa_hexdump(MSG_DEBUG, "MBO: Association Request attributes", pos, len);  in mbo_ap_check_sta_assoc()
96 	attr = get_ie(pos, len, MBO_ATTR_ID_CELL_DATA_CAPA);  in mbo_ap_check_sta_assoc()
101 	end = pos + len;  in mbo_ap_check_sta_assoc()
102 	while (end - pos > 1) {  in mbo_ap_check_sta_assoc()
103 		u8 ie_len = pos[1];  in mbo_ap_check_sta_assoc()
105 		if (2 + ie_len > end - pos)  in mbo_ap_check_sta_assoc()
108 		if (pos[0] == MBO_ATTR_ID_NON_PREF_CHAN_REPORT)  in mbo_ap_check_sta_assoc()
109 			mbo_ap_parse_non_pref_chan(sta, pos + 2, ie_len);  in mbo_ap_check_sta_assoc()
110 		pos += 2 + pos[1];  in mbo_ap_check_sta_assoc()
117 	char *pos = buf, *end = buf + buflen;  in mbo_ap_get_info()  local
126 	ret = os_snprintf(pos, end - pos, "mbo_cell_capa=%u\n", sta->cell_capa);  in mbo_ap_get_info()
127 	if (os_snprintf_error(end - pos, ret))  in mbo_ap_get_info()
128 		return pos - buf;  in mbo_ap_get_info()
129 	pos += ret;  in mbo_ap_get_info()
132 		char *pos2 = pos;  in mbo_ap_get_info()
161 		pos = pos2;  in mbo_ap_get_info()
164 	return pos - buf;  in mbo_ap_get_info()
211 	const u8 *pos, *end;  in mbo_ap_wnm_notification_req()  local
223 	pos = buf;  in mbo_ap_wnm_notification_req()
226 	while (end - pos > 1) {  in mbo_ap_wnm_notification_req()
227 		ie_len = pos[1];  in mbo_ap_wnm_notification_req()
229 		if (2 + ie_len > end - pos)  in mbo_ap_wnm_notification_req()
232 		if (pos[0] == WLAN_EID_VENDOR_SPECIFIC &&  in mbo_ap_wnm_notification_req()
233 		    ie_len >= 4 && WPA_GET_BE24(pos + 2) == OUI_WFA)  in mbo_ap_wnm_notification_req()
234 			mbo_ap_wnm_notif_req_elem(sta, pos[5],  in mbo_ap_wnm_notification_req()
235 						  pos + 6, ie_len - 4,  in mbo_ap_wnm_notification_req()
240 				   pos[0], pos[1]);  in mbo_ap_wnm_notification_req()
242 		pos += 2 + pos[1];  in mbo_ap_wnm_notification_req()