An inverted comparison in the ieee80211_michael_mic_failure() function of OpenBSD’s ieee80211_crypto_tkip.c allows attackers to cause a denial of service. By sending two malformed TKIP frames separated by more than 60 seconds, a malicious actor can exploit a reversed countermeasure window and deauthenticate all associated TKIP stations. The failure countermeasure that should trigger a response to MIC failures is mistakenly ignored, so the associated devices are blocked from reassociating for up to 90 seconds, disrupting network connectivity for any connected clients using TKIP.

The vulnerability exists in all OpenBSD systems using the ieee80211_crypto_tkip.c implementation prior to the commit identified as 1ee99dfc4ddc87afc6395d5d3094e9d2314fb5a. It applies to any OpenBSD configuration that relies on TKIP authentication or key management for wireless networks.

With a CVSS score of 6, the threat is moderate and the exploit requires the attacker to be within wireless radio range of the affected device. The EPSS score is not provided and the issue is not listed in CISA KEV, which suggests a lower likelihood of widespread exploitation. Nonetheless, the DoS capability can cause significant service disruption in environments that still use TKIP, and the limited window (up to 90 seconds of forced deauthentication) can affect critical real‑time applications.