This is a false positive. The nla stuff has checking which is pretty tricky for static analysis to handle. Here is how that attribute is defined. net/wireless/nl80211.c 544 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 545 .len = IEEE80211_MAX_SSID_LEN }, When the NL80211_ATTR_SSID attr is parsed it's capped at 0-IEEE80211_MAX_SSID_LEN because of this. regards, dan carpenter