{
  "finding_id": "DF-3429",
  "file": "sys/netproto/802_11/wlan/ieee80211_wds.c",
  "title": "DWDS discovery frames leak permanently on stage-queue age-out: ieee80211_node_timeout discards the mbuf list returned by ieee80211_ageq_age (remote memory-exhaustion DoS)",
  "verdict": "inconclusive",
  "impact": "none",
  "severity": "Medium",
  "reproduce": {
    "build": "n/a (kernel defect)",
    "run": "./run.sh (documents QEMU hardware gate: no radio attaches)",
    "expected": "on hardware: sustained 4-addr frames from associated station with no WDS vap plumbed -> netstat -m cluster count grows monotonically -> OOM"
  },
  "kernel_refs": ["sys/netproto/802_11/wlan/ieee80211_wds.c:321-338", "sys/netproto/802_11/wlan/ieee80211_node.c:2255", "sys/netproto/802_11/wlan/ieee80211_ageq.c:162-185"],
  "artifacts": ["README.md","VERDICT.md","trigger_stageq_leak.c","run.sh","wlan_gate.txt","fix.diff","verdict.json","manifest.json"]
}