Buffer overflow on parsing IEEE 802.11 control frames.
vulners.com/securityvulns/securityvulns:doc:11130
vulners.com/securityvulns/securityvulns:doc:11132