Add 802.1X (WPA2-Enterprise) support for a userspace supplicant

[dantdmdarealguy]

Related: #101 (also asked in #230, #240), OpenIntelWireless/HeliPort#4, OpenIntelWireless/HeliPort#288
Includes the one-line fix from #1074 as its first commit; merge that first or together.

Summary

itlwm can't join WPA2-Enterprise networks today. This adds the minimum kernel
support needed for a userspace EAP supplicant (implemented in HeliPort, OpenIntelWireless/HeliPort#288) to do it.
In line with the concern raised in #101, the kext has no certificate handling, TLS
or EAP logic. It only moves EAPOL frames and installs the PMK that userspace
derives. The existing net80211 4-way handshake code is reused unchanged.

Changes

• EAPOL receive path. On 802.1X networks, non-Key EAPOL frames (EAP-Packet /
  Start / Logoff) are handed to itlwm through a global hook
  (ieee80211_eapol_input). itlwm queues them in a small ring buffer (16 frames)
  for userspace. Previously ieee80211_eapol_key_input() dropped them. EAPOL-Key
  frames stay in the kernel for the 4-way handshake.
  • struct ieee80211com is unchanged, so the HAL softcs that embed it keep their
    layout. The hook gets the ieee80211com and finds the owning itlwm instance
    from its interface.
  • Each instance only accepts frames between a successful start() and stop().
  • The EAPOL type is read with mbuf_copydata(), so chained mbufs are handled.
  • Only the itlwm build is affected; AirportItlwm (IO80211FAMILY_V2) is untouched.
• New user-client calls, appended after the existing IDs:
  • IOCTL_80211_ASSOCIATE_ENTERPRISE: join an SSID with RSN, AKM 802.1X and no PSK.
  • IOCTL_80211_TX_EAPOL: transmit an EAPOL frame built in userspace. It's needed
    because the interface link stays down until the 4-way handshake completes, and
    macOS drops ordinary writes on a down interface. Only EtherType 0x888E is
    accepted.
  • IOCTL_80211_RX_EAPOL: fetch the next queued frame. It returns length 0 when
    the queue is empty.
  • ID 13 is reserved and always rejected, because kexts without Fix out-of-bounds dispatch in ItlNetworkUserClient::externalMethod #1074 panic on it.
    Clients detect support by calling RX_EAPOL; older kexts reject that selector
    safely.
• IOCTL_80211_WPA_KEY was a no-op stub. It now delivers the PMK after EAP, or a
  failure status, which deauths.
  • The PMK goes into the PMKSA cache under the negotiated AKM, the same mechanism as
    OpenBSD's SIOCS80211KEYAVAIL, so ieee80211_recv_4way_msg1() picks it up
    as-is.
  • It's only accepted for the SSID the driver is currently joining.
  • It runs on the driver's work loop (command gate), so the PMKSA cache and the
    state machine aren't changed while the receive path is using them. So does
    ASSOCIATE_ENTERPRISE.
• externalMethod() checks the input/output size against each selector's
  struct before the handler casts the buffer.
• Enterprise association requests WPA2 with AKM 802.1X only (no WPA1, no
  SHA256-802.1X / 802.11w).
• ClientKit headers updated to match HeliPort's copy.

Prebuilt binaries

Until this is merged, an unofficial prebuilt itlwm.kext + HeliPort.app built from these PRs is on my fork's releases page: https://github.com/dantdmdarealguy/itlwm/releases. The two only work together, and only with itlwm (not AirportItlwm).

Testing

• macOS 15.7.7, Intel Wireless-AC 9560 (8086:34F0, subsystem 0034), OpenCore 1.0.7.
• Texas A&M TAMU_WiFi (PEAP / MSCHAPv2):
  • first connect;
  • auto-join of the saved network at login;
  • reauthentication on an established association (supplicant-triggered
    EAPOL-Start).
• Personal (PSK) and open networks unaffected.
• The CI targets build: itlwm and AirportItlwm (all) (Debug), plus itlwm
  Release.

Known limitations

• PEAP/MSCHAPv2 only (method support lives in HeliPort); WPA2-Enterprise only.
• Brief outage on reauthentication. After a supplicant-triggered reauth on
  TAMU_WiFi, the AP ran a second full EAP exchange about 3 s later. Both
  succeeded, but connectivity dropped for about 1.4 s.
  • I suspect the AP reuses the replay counter on Message 1, which
    ieee80211_recv_4way_msg1() rejects.
  • I left the key-handling code alone rather than relax that check.
• Tested on one network and one card so far.