# DF-0295 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: setappie swaps *aie=napp then IEEE80211_FREE(old) under only the lock; the code's own XXX admits the TX paths read iv_appie_* without a ref -> UAF. Privileged.

## Impact ceiling
none

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_ioctl.c:2272

## Fix
Avoid the UAF by leaking the old appie on the delete path until the TX paths are refcounted (documented tradeoff); full fix needs appie refcounts.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.