mde_equal() compares its first argument to itself
   CWE-697.  CVSS 3.1: 3.1 Low
   CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
   src/ft.c:385
   Introduced 1.14, commit 2c0234e1

     return memcmp(mde1, mde1, mde1[1] + 2) == 0;

   mde2 is never read, so the check always passes.  Its only caller is
   ft_parse_ies() (ft.c:667), where it should confirm the target AP echoed
   the Mobility Domain element the station sent on the 802.11r FT
   Authentication Response and FT-over-DS paths.  Not an authentication
   bypass - __ft_rx_associate() compares correctly at ft.c:496 and the FTE
   MIC there is keyed on PMK-R1 - but a response carrying an arbitrary
   mobility domain ID and FT capability flags passes the authentication
   stage into FTE parsing and key derivation.  Finding 4 sits on that path,
   one call later.