# DF-0323 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ampdu_dispatch calls ieee80211_input inside the rxa_m[] iteration loops; M_AMPDU_MPDU only bypasses the reorder path, not BAR/action/crypto that touch rap -> iterator/state invalidation. Existing KASSERTs exist because this has gone wrong before. Remote A-MPDU.

## Impact ceiling
none

## Cited refs
- sys/netproto/802_11/wlan/ieee80211_ht.c:617

## Fix
Documented the re-entry hazard; full fix must defer/snapshot the iteration. Comment-only (compiles).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=not_testable.