{
  "finding_id": "DF-3430",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "ieee80211_create_wdss station already in use branch (ieee80211_wds.c:163-175) never drops the +1 node reference acquired by ieee80211_find_node_locked (ieee80211_node.c:1391): the station nodes refcount is permanently inflated and the node can never be reclaimed, polluting ic_sta until reboot. Repeatable via two WDS vaps sharing one iv_des_bssid (alternating INIT->RUN transitions re-arm the branch because node_table_resets second pass clears ni_wdsvap on INIT). Low severity: privileged local plumbing required, slow resource exhaustion, no memory unsafety. FreeBSD HEAD has the identical branch (ieee80211_wds.c:161-167) - inherited. Phase V skipped per audit policy for Low findings (and the QEMU guest has no 802.11 radio).",
  "exploit_chain": "",
  "evidence": "README.md (branch analysis); trigger_create_wds_refleak.c (annotated); fix.diff",
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_wds.c:149",
    "sys/netproto/802_11/wlan/ieee80211_wds.c:163",
    "sys/netproto/802_11/wlan/ieee80211_wds.c:181",
    "sys/netproto/802_11/wlan/ieee80211_node.c:1391",
    "sys/netproto/802_11/wlan/ieee80211_node.c:2004"
  ],
  "poc_changes": "No seed; analysis-only pack (Low severity => Phase V skipped by policy).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "c48a3fa9532b4e778c1dfcd7b8ec63f484d881bfd0bef198cec5744dd2467592",
  "notes": "Pass-2 wds.c finding beyond DF-0618 (age KASSERT). Upstream FreeBSD identical - coordinate disclosure.",
  "recommended_fix": "ieee80211_free_node(ni) in the in use branch of ieee80211_create_wds; see fix.diff.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "one-line refcount fix authored; not validated (Low severity, no radio hardware on guest)",
  "fix_evidence": "fix.diff"
}