Closes out the 6-item roadmap from this cycle:
- Self-healing monitor-mode/channel-drift check — radio.py detects and recovers from an interface silently dropping out of monitor mode or drifting off-channel (NetworkManager reasserting control, a driver reset), instead of failing silently mid-attack or mid-scan.
- OWE (Enhanced Open) transition-mode downgrade attack — parses the OWE Transition Mode IE to find an AP's paired open network and forces a downgrade to it. Built and unit-tested; not yet verified against a real OWE-transition AP.
- Dragonblood SAE timing side-channel (CVE-2019-9494) — offline hunting-and-pecking iteration-count math, SAE Commit frame crafting, and a live timing-measurement/wordlist-pruning attack. Built and unit-tested; only meaningful against an unpatched pre-hostapd-2.10 AP, none available to verify against yet.
- dpkt swap in scan.py — replaced scapy's packet dissection with dpkt in the scan hot path (the CPU/fan-noise fix), after finding and working around a real byte-order bug in dpkt's own beacon-capability parsing (confirmed pypacker has the identical bug). Live-verified against real hardware.
- Cracking how-to documentation (README/README_ES).
CSA (Channel Switch Announcement) spoofing remains deliberately deferred — no published PoC or reference exists anywhere to build against.
Full technical detail for every item is in CHECKPOINT.md/STATUS.md in the repo.