# DF-0606 — PoC: _db_show_mesh invokes state-mutating helper from DDB

Privileged local DDB-safety defect. `_db_show_mesh()` calls
`ieee80211_mesh_rt_update(rt, 0)` which acquires a `lockmgr` lock and
mutates the route entry — both unsafe from DDB (panic context with frozen
scheduler). Result: deadlock, double-panic / forced reboot, or silent
corruption of the mesh routing table.

## Files

- `repro.sh` — shell driver (load wlan_mesh, create mesh vap, trigger DDB,
  run `show vap <addr> m`).
- (added by per-PoC verifier) full C harness / ddb script, `build.sh`,
  `run.sh`, `run.log`, `VERDICT.md`, `manifest.json`, `fix.diff`.

## Build & run

```sh
kldload wlan wlan_mesh
ifconfig wlan0 create wlandev wifi0 wlanmode mesh
ifconfig wlan0 up
# (join an existing MBSS peer so ms_routes is non-empty)

sysctl debug.kdb.enter=1

# at the db> prompt:
db> show vap <mesh-vap-addr> m
```

## Expected outcome

One of:
- The ddb session hangs (`lockmgr` deadlock in the frozen scheduler).
- Double-fault to immediate reboot (`Fatal double fault` / re-entering trap
  from inside ddb).
- If it returns: running the command twice shows `rt_lifetime` collapsing
  to `0` and `rt_flags` losing `VALID` on previously-good routes, proving
  the display mutated the table.

## Notes for the per-PoC verifier

- Requires `wlan_mesh` module loaded and an MBSS vap with at least one
  route in `ms_routes`. Verify with `ifconfig wlan0 list mesh` before
  triggering DDB.
- The `<mesh-vap-addr>` can be found by walking the ifnet list in ddb
  (`show all/ifps`) or by inspecting the ic's vap TAILQ.
- Verify the fix with `git apply findings/poc/DF-0606/fix.diff` (read
  `rt->rt_lifetime` directly instead of calling
  `ieee80211_mesh_rt_update`); after the fix, `show vap <addr> m` should
  return cleanly without mutating the table or deadlocking.