{
 "finding_id": "DF-3312",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Legacy WDS peer nodes initialized by ieee80211_ht_wds_init get NODE_HT|NODE_AMPDU but tap->txa_ni is never assigned (only ieee80211_ht_node_init:1084 assigns it); with HT re-enabled on the WDS vap (HTCONF ioctl, no opmode restriction) and >=64 pps BE traffic the stack sends an ADDBA request, and 250 ms of peer silence makes addba_timeout() deref NULL txa_ni -> deterministic page fault at va 0x8 in softclock context. Reproduced twice on the stock INVARIANTS guest; one-line fix (txa_ni = ni in ieee80211_ht_wds_init) validated by nativekernel rebuild: identical PoC no longer panics, tap->txa_ni non-NULL, guest stays up. Remote-peer-triggerable DoS (panic) on WDS+11n deployments; no exploitation primitive (fixed NULL+8 read).",
 "exploit_chain": "HT radio + legacy WDS vap (wlanmode wds wlanbssid <peer> wdslegacy) + ifconfig <wds> ht -> RUN -> ieee80211_create_wds legacy branch -> ieee80211_node_create_wds -> ieee80211_ht_wds_init (txa_ni stays NULL, node M_ZERO) -> unicast traffic >= mintraffic threshold -> ieee80211_ampdu_request -> addba_start_timeout (250 ms) -> peer silence -> addba_timeout: ni = tap->txa_ni (NULL); ic = ni->ni_ic -> Fatal trap 12, fault va 0x8, Stopped at addba_timeout+0x6. Teardown paths ampdu_tx_stop:1731 and bar_timeout:2282 deref the same NULL.",
 "evidence": [
  "run.log: decisive baseline run \u2014 tap->txa_ni = 0, txa_flags=0xb (ADDBA pending), then Fatal trap 12 ... fault virtual address = 0x8 ... Stopped at addba_timeout+0x6: movq 0x8(%rdi),%rax, current process Idle (callout)",
  "panic.txt: full serial-console capture of the trap",
  "patched_run.txt: fixed-kernel rerun \u2014 tap->txa_ni = 0xfffff80118743400, same traffic + ADDBA pending, no trap",
  "fix.log: patch apply + nativekernel build/install + post-PoC status (guest up, 0 fatal traps)",
  "fw2.c: software-radio KLD (HT 11ng fake radio, WDS-capable, paced-traffic sysctl kern.fw2_fire)"
 ],
 "kernel_refs": [
  "sys/netproto/802_11/wlan/ieee80211_ht.c:1248",
  "sys/netproto/802_11/wlan/ieee80211_ht.c:1084",
  "sys/netproto/802_11/wlan/ieee80211_ht.c:1772",
  "sys/netproto/802_11/wlan/ieee80211_ht.c:1731",
  "sys/netproto/802_11/wlan/ieee80211_ht.c:2282",
  "sys/netproto/802_11/wlan/ieee80211_node.c:1350",
  "sys/netproto/802_11/wlan/ieee80211_wds.c:200",
  "sys/netproto/802_11/wlan/ieee80211_ioctl.c:2972"
 ],
 "poc_changes": "Two harness fixes vs first draft: (1) take one ieee80211_ref_node per frame (ieee80211_vap_pkt_send_dest consumes a node ref per call -- first run UAFd in ieee80211_tx_complete, PoC bug not finding bug); (2) assign ic_raw_xmit/ic_transmit AFTER ieee80211_ifattach (proto_attach overwrites them with null_raw_xmit, cosmetic). Finding-side PoC seed: none existed (pass-2 new finding); trigger sequence matches analysis exactly.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 462,
 "guest_dirty": 0,
 "build_cmd": "sh findings/poc/DF-3312/build.sh (in-guest: cd /root/fw2 && make SYSDIR=/usr/src/sys)",
 "run_cmd": "sh findings/poc/DF-3312/run.sh",
 "code_hash": "b0249e775cfa50e3bb54c7cf45a1e283f0b87c6ec10e528caa37090b1e6664b5",
 "notes": "Non-legacy (DWDS) nodes unaffected (assoc path calls ieee80211_ht_node_init). Fixed NULL+8 read -- DoS only, no uid0 route. Guest reset with-src after validation. Related non-filed nit: null_raw_xmit (ieee80211_proto.c:250) drops frames without freeing the node ref, violating the raw_xmit contract.",
 "recommended_fix": "Assign tap->txa_ni = ni in ieee80211_ht_wds_init (mirrors ieee80211_ht_node_init:1084); see fix.diff -- validated by kernel rebuild.",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Thu Sep 10 14:40:48 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "One-line fix.diff applied to guest /usr/src, nativekernel rebuilt+installed (#1 Sep 10 14:40:48), rebooted, exact baseline PoC re-run: tap->txa_ni now 0xfffff80118743400, ADDBA request armed (txa_flags=0xb) and timed out repeatedly with no trap; guest stayed up (dmesg fatal-trap count 0). Bad behavior gone.",
 "fix_evidence": "fix.log, patched_run.txt"
}