fix(ap-mode): validate cidr prefix range in bring up interface

[vaibhavsrv]

Why this matters

In ods/scripts/ap-mode.sh, bring_up_interface() resolved the network prefix from $ODS_AP_PREFIX (or derived it from $ODS_AP_NETMASK) and directly executed ip addr add "${ODS_AP_GATEWAY_IP}/${prefix}" dev "${ODS_AP_INTERFACE}" without bounds checking the prefix value. If an operator set an invalid or out-of-range CIDR prefix (such as 0, 33, 99, negative values, or non-numeric tokens), the script brought the interface up, flushed IP addresses, and then aborted with an unhandled iproute2 command failure, leaving the wireless interface in a detached, unconfigured state.

This change introduces strict range validation ([[ "$prefix" =~ ^[0-9]+$ ]] && (( prefix >= 1 && prefix <= 32 ))) before performing interface configuration. Invalid prefix values fail early with a descriptive error message. Existing netmask conversion, gateway IP defaults, and captive portal iptables rules remain untouched.

Validation

• Baseline reproduction: Calling bring_up_interface with an invalid ODS_AP_PREFIX=99 or non-numeric value progressed to ip addr add without prefix validation.
• Post-fix verification: Running ods/tests/test_ap_mode_prefix_validation.py asserts that invalid CIDR prefixes (0, 33, 99, -1, "abc") are rejected immediately with exit code 1 and error messaging, while standard valid subnets pass validation.
• Telemetry: AP mode test suite: test_ap_mode_prefix_validation.py passes cleanly (exit code 0). Wired into Linux CI workflow under AP network identity preflight.

Overlap check

• fix(ap-mode): strip whitespace and quotes in netmask to prefix conversion #5623: Addressed whitespace stripping in _netmask_to_prefix.
• fix(hermes): enforce trailing newline on patched hermes config #6085 (PR 10): Addressed trailing newlines in patch-hermes-config.py.
• Does not modify hostapd or dnsmasq configuration generation or DHCP lease ranges.

Risk / AI disclosure

AI-assisted investigation, implementation, and test regressions. This strengthens CIDR prefix validation during AP interface bring-up. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #6076, #6077, #6078, #6079, #6080, #6081, #6082, #6083, #6084, and #6085 at HEAD without conflicts. Production and test diffs passed together; AP mode and network identity checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.