# DF-0320 PoC — WiFi A-MSDU reorder buffer race

## Status: REAL (source-trace confirmed), not testable on this guest

The race is confirmed by tracing three concurrent mutators of
`rxa_m[]` with no dedicated lock:
- RX reorder write at `ieee80211_ht.c:911`
- Node-age flush at `:1151`
- ADDBA memset at `:553`

**Not testable** because:
- No WiFi hardware on this guest
- `wlan` module not loaded at runtime
- Requires a remote WiFi peer interleaving A-MPDU + ADDBA frames

The code IS compiled into GENERIC (`device wlan`).

## Fix

See `fix.diff` — adds `struct spinlock rxa_lock` to
`struct ieee80211_rx_ampdu` and wraps the critical sections.
Verified to compile cleanly on GENERIC.