Fix: Validate MAC addresses to filter invalid ones

- Add is_valid_mac() function
- Reject MACs starting with 00: or FF: (invalid/broadcast)
- Reject malformed MACs

package/src/client2server-minimal.lua

@@ -162,6 +162,22 @@ local function get_all_ssids()
 end
 
 -- Get clients from ALL interfaces WITH their SSID
+-- Validate MAC address (proper format with valid hex)
+local function is_valid_mac(mac)
+    if not mac or #mac ~= 17 then return false end
+    -- Check format XX:XX:XX:XX:XX:XX
+    local parts = {}
+    for part in mac:gmatch("[a-fA-F0-9][a-fA-F0-9]") do
+        table.insert(parts, part)
+    end
+    -- Must have exactly 6 parts
+    if #parts ~= 6 then return false end
+    -- First byte must not be 00 or FF (invalid/broadcast)
+    local first = tonumber(parts[1], 16)
+    if first == 0 or first == 255 then return false end
+    return true
+end
+
 local function get_wifi_clients()
     local clients = {}
     local interfaces = get_hostapd_interfaces()
@@ -182,8 +198,8 @@ local function get_wifi_clients()
             if result:find('"clients"') and not result:find('"clients":%s*{}') then
                 -- Extract MAC addresses - match pattern for valid MACs
                 for mac in result:gmatch('([a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9])') do
-                    -- Only add if not already tracked (first interface wins)
-                    if not clients[mac] then
+                    -- Validate MAC before adding
+                    if is_valid_mac(mac) and not clients[mac] then
                         clients[mac] = { iface = iface, ssid = ssid_map[iface] }
                     end
                 end