{
  "finding_id": "DF-3438",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Info/hardening, not exercised (guest has no 802.11 radio, so cipher keys cannot be installed against a real cipher module). Code walk: ieee80211_crypto_unregister (ieee80211_crypto.c:213-228) clears ciphers[cip] with the in-code admission XXX disallow if references - no reference accounting exists; the policy-module unload gate (_IEEE80211_POLICY_MODULE, ieee80211_dragonfly.h:250-262) checks the cipher modules nrefs unsynchronized against the nrefs++ the cipher performs in ic_attach under the key-update lock (ieee80211_crypto_ccmp.c:115). kldunload wlan_ccmp racing a CCMP key install can unlink the module while key->wk_cipher still points into it; subsequent ic_encap/ic_decap/ic_detach calls through that key jump into unmapped module text (UAF). Both trigger sides are root-gated; the window is narrow; severity Info for triage but the consequence is a kernel UAF.",
  "exploit_chain": "",
  "evidence": [
    "README.md: path:line walk (unregister vs attach/nrefs)"
  ],
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_crypto.c:194",
    "sys/netproto/802_11/wlan/ieee80211_crypto.c:213",
    "sys/netproto/802_11/wlan/ieee80211_crypto.c:227",
    "sys/netproto/802_11/ieee80211_dragonfly.h:250",
    "sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c:115"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Fix the codes own TODO: per-cipher reference count taken in ic_attach and dropped in ic_detach, checked under the wlan serialization in ieee80211_crypto_unregister / the module unload gate.",
  "recommended_fix": "Add reference counting to the cipher registry so unregister/unload is refused while keys are bound to the cipher."
}