=== DF-3312 baseline panic (stock INVARIANTS kernel #0, Jul 2 2026) ===
trigger: legacy WDS vap (wdslegacy) + HT re-enabled ('ifconfig wlan1 ht') + traffic
         -> ADDBA request into the void -> addba_timeout 250ms later

Local package initialization:.

Thu Sep 10 14:35:33 UTC 2026
fw2: fake HT wifi radio attached (fw2_0, 11ng)


DragonFly/x86_64 (dfbsd) (ttyd0)



login: wlan0: MAC address: 02:00:00:00:00:f2
fw2_0: need multicast update callback
fw2_0: need multicast update callback
wlan1: MAC address: 02:00:00:00:00:f2
fw2_0: need multicast update callback
fw2_0: need multicast update callback
fw2.fire: vap wlan1 RUN, peer 02:de:ad:be:ef:00
fw2.fire: ni_flags=0xc61 (NODE_HT=0x40 NODE_AMPDU=0xc00)
fw2.fire: vap iv_flags_ht=0x15b80000 (FHT_HT=0x80000 FHT_AMPDU_TX=0x100000)
fw2.fire: *** tap->txa_ni = 0 (NULL => addba_timeout panic) ***
fw2.fire: round 0 done: txa_avgpps=0 txa_pkts=1001 txa_flags=0x0 (XCHGPEND=0x2)
fw2.fire: round 1 done: txa_avgpps=0 txa_pkts=2001 txa_flags=0x0 (XCHGPEND=0x2)
fw2.fire: round 2 done: txa_avgpps=0 txa_pkts=3001 txa_flags=0x0 (XCHGPEND=0x2)
fw2.fire: round 3 done: txa_avgpps=0 txa_pkts=4001 txa_flags=0x0 (XCHGPEND=0x2)
fw2.fire: round 4 done: txa_avgpps=0 txa_pkts=5002 txa_flags=0x0 (XCHGPEND=0x2)
fw2.fire: round 5 done: txa_avgpps=1250 txa_pkts=1000 txa_flags=0xb (XCHGPEND=0x2)
fw2.fire: ADDBA request pending, no peer will answer -- addba_timeout fires in ~250ms
fw2.fire: done, waiting for addba_timeout...


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x8
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff807649f6
stack pointer	        = 0x10:0xfffff800897559d8
frame pointer	        = 0x10:0xfffff80089755ab0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      addba_timeout+0x6:      movq    0x8(%rdi),%rax
db>