524 	uint8_t *frm, *efrm;  in ieee80211_parse_beacon()  local
527 	frm = (uint8_t *)&wh[1];  in ieee80211_parse_beacon()
554 	IEEE80211_VERIFY_LENGTH(efrm - frm, 12,  in ieee80211_parse_beacon()
557 	scan->tstamp  = frm;				frm += 8;  in ieee80211_parse_beacon()
558 	scan->bintval = le16toh(*(uint16_t *)frm);	frm += 2;  in ieee80211_parse_beacon()
559 	scan->capinfo = le16toh(*(uint16_t *)frm);	frm += 2;  in ieee80211_parse_beacon()
562 	scan->ies = frm;  in ieee80211_parse_beacon()
563 	scan->ies_len = efrm - frm;  in ieee80211_parse_beacon()
565 	while (efrm - frm > 1) {  in ieee80211_parse_beacon()
566 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2,  in ieee80211_parse_beacon()
568 		switch (*frm) {  in ieee80211_parse_beacon()
570 			scan->ssid = frm;  in ieee80211_parse_beacon()
573 			scan->rates = frm;  in ieee80211_parse_beacon()
576 			scan->country = frm;  in ieee80211_parse_beacon()
579 			scan->csa = frm;  in ieee80211_parse_beacon()
582 			scan->quiet = frm;  in ieee80211_parse_beacon()
586 				scan->fhdwell = le16dec(&frm[2]);  in ieee80211_parse_beacon()
587 				scan->chan = IEEE80211_FH_CHAN(frm[4], frm[5]);  in ieee80211_parse_beacon()
588 				scan->fhindex = frm[6];  in ieee80211_parse_beacon()
597 				scan->chan = frm[2];  in ieee80211_parse_beacon()
601 			scan->tim = frm;  in ieee80211_parse_beacon()
602 			scan->timoff = frm - mtod(m, uint8_t *);  in ieee80211_parse_beacon()
612 			scan->xrates = frm;  in ieee80211_parse_beacon()
615 			if (frm[1] != 1) {  in ieee80211_parse_beacon()
618 				    "bad len %u", frm[1]);  in ieee80211_parse_beacon()
622 			scan->erp = frm[2] | 0x100;  in ieee80211_parse_beacon()
625 			scan->htcap = frm;  in ieee80211_parse_beacon()
628 			scan->vhtcap = frm;  in ieee80211_parse_beacon()
631 			scan->vhtopmode = frm;  in ieee80211_parse_beacon()
634 			scan->rsn = frm;  in ieee80211_parse_beacon()
637 			scan->htinfo = frm;  in ieee80211_parse_beacon()
641 			scan->meshid = frm;  in ieee80211_parse_beacon()
644 			scan->meshconf = frm;  in ieee80211_parse_beacon()
651 			if (iswpaoui(frm))  in ieee80211_parse_beacon()
652 				scan->wpa = frm;  in ieee80211_parse_beacon()
653 			else if (iswmeparam(frm) || iswmeinfo(frm))  in ieee80211_parse_beacon()
654 				scan->wme = frm;  in ieee80211_parse_beacon()
656 			else if (isatherosoui(frm))  in ieee80211_parse_beacon()
657 				scan->ath = frm;  in ieee80211_parse_beacon()
660 			else if (istdmaoui(frm))  in ieee80211_parse_beacon()
661 				scan->tdma = frm;  in ieee80211_parse_beacon()
668 				if (ishtcapoui(frm)) {  in ieee80211_parse_beacon()
670 						scan->htcap = frm;  in ieee80211_parse_beacon()
671 				} else if (ishtinfooui(frm)) {  in ieee80211_parse_beacon()
673 						scan->htcap = frm;  in ieee80211_parse_beacon()
680 			    "id %u, len %u", *frm, frm[1]);  in ieee80211_parse_beacon()
684 		frm += frm[1] + 2;  in ieee80211_parse_beacon()
797 	uint8_t *frm, *efrm;  in ieee80211_parse_action()  local
806 	frm = (u_int8_t *)&wh[1];  in ieee80211_parse_action()
808 	IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()
810 	ia = (const struct ieee80211_action *) frm;  in ieee80211_parse_action()
820 			IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()
825 			IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()
830 			IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()
839 			IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()
844 			IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()
858 			IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()
866 			IEEE80211_VERIFY_LENGTH(efrm - frm,  in ieee80211_parse_action()