# DF-0289: WiFi Mesh Route UAF / TOCTOU

## Finding
`ieee80211_mesh_rt_find()` (ieee80211_mesh.c:230-241) returns a route pointer
after releasing MESH_RT_LOCK. Callers dereference rt->rt_flags/rt_nexthop
unlocked. `ms_cleantimer` can free routes concurrently. `forward_to_gates()`
drops/reacquires the lock inside TAILQ_FOREACH_SAFE, allowing the next cursor
to be freed — UAF of mesh route/gate struct.

## Reproduction
This is a code-confirmed finding. Runtime reproduction requires WiFi mesh
hardware (802.11s), which is not present on this QEMU guest (vtnet0 only).

The mesh code IS compiled into the kernel:
```
nm /boot/kernel/kernel | grep ieee80211_mesh_rt_find
```

To reproduce on hardware with WiFi mesh:
1. Create a mesh VAP (wlan0 mesh mode)
2. Generate mesh traffic + route churn
3. Observe UAF panic in dmesg during forward_to_gates or route lookup

## Fix
See fix.diff — removes the MESH_RT_UNLOCK/LOCK pair inside forward_to_gates's
TAILQ_FOREACH_SAFE loop, keeping the lock held for the entire iteration.