# DF-0580 — ieee80211_defrag UAF (DragonFly m_cat frees source mbuf)
# NOT runtime-triggerable on the audit guest (no Wi-Fi HW). See VERDICT.md.
echo "DF-0580: ieee80211_defrag use-after-free via DragonFly m_cat."
echo "Runtime trigger needs a Wi-Fi adapter receiving a small unicast 2nd"
echo "fragment whose payload fits the reassembly mbuf's trailing space."
echo "m_cat() then frees the fragment before ieee80211_defrag re-reads its"
echo "pkthdr.len and i_seq.  This QEMU guest has no Wi-Fi radio, so the RX"
echo "path is unreachable here.  Bug CONFIRMED at source; fix compiled in-kernel."
exit 0