{
  "finding_id": "DF-3460",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "REPRODUCED (code-level harness; module latent on this guest). rssadapt_deinit (ieee80211_rssadapt.c:151-155) frees vap->iv_rs without clearing it, and is invoked from every wifi drivers vap_delete (e.g. if_iwm.c:6486-6493 ieee80211_ratectl_deinit -> ieee80211_vap_detach) while the sysctl oid net.wlan.N.rssadapt_rate_interval (CTLFLAG_RW, world-readable; registered at :356-362) is only removed by ieee80211_sysctl_vdetach at ieee80211.c:827 \u2014 the LAST step of vap_detach. Across that whole teardown window the handler (rssadapt_sysctl_interval :340-353) dereferences the dangling iv_rs: an unprivileged `sysctl net.wlan.N.rssadapt_rate_interval` racing `ifconfig wlanN destroy` reads 4 bytes of a freed (kmalloc size-class reused) chunk \u2014 a kernel-heap info-leak gadget; the root write path stores 4 controlled bytes into the freed chunk via rssadapt_setinterval. Harness demonstrates both with the chunk handed straight back to a replacement object (same address). Latent for rssadapt (optional module, no selector, no radio) \u2014 but the IDENTICAL pattern in the DEFAULT algorithm amrr (ieee80211_amrr.c:135 amrr_deinit; :390-403 amrr_sysctl_interval; :405-417 SYSCTL_ADD_UINT pointing directly into the chunk) is reachable on any real WiFi system and should be fixed in the same stroke.",
  "exploit_chain": "",
  "evidence": [
    "findings/poc/DF-3460/run.log \u2014 buggy run: freed chunk reused at the same address; unprivileged read returns replacement-object bytes (0xdeadbeef); root write lands 0x12c into the replacement object",
    "findings/poc/DF-3460/run.fixed.log \u2014 deinit clears iv_rs; handler returns ENXIO during the window; no UAF",
    "findings/poc/DF-3460/fix_module_build.log \u2014 patched wlan_rssadapt.ko builds clean, full kernel -Werror CFLAGS, rc=0",
    "findings/poc/DF-3460/df3460_harness.c \u2014 exact handler/lifetime replica (built -O0: gcc -O2 CSEs the post-free load away \u2014 UB elision the kernel does not perform)"
  ],
  "kernel_refs": [
    "sys/netproto/802_11/wlan/ieee80211_rssadapt.c:151",
    "sys/netproto/802_11/wlan/ieee80211_rssadapt.c:340",
    "sys/netproto/802_11/wlan/ieee80211_rssadapt.c:344",
    "sys/netproto/802_11/wlan/ieee80211_rssadapt.c:356",
    "sys/dev/netif/iwm/if_iwm.c:6486",
    "sys/netproto/802_11/wlan/ieee80211.c:826",
    "sys/netproto/802_11/wlan/ieee80211.c:827",
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:135",
    "sys/netproto/802_11/wlan/ieee80211_amrr.c:390"
  ],
  "poc_changes": "Harness is self-authored (no seed). Iterations: (1) nested /* inside the header comment broke the build; (2) poison initially written at the wrong offset (interval is at struct offset 8) \u2014 now the whole replacement object is poisoned and marker2 (offset 8) checked; (3) build switched to -O0 because gcc -O2 CSEs the post-free load with the pre-free one (UB elision), hiding the reuse \u2014 the kernel performs no such elision across the real sysctl dispatch.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh          (buggy)   /   sh build.sh fixed   (fixed)   [on guest: cc -O0 -Wall -o df3460_harness df3460_harness.c]",
  "run_cmd": "./run.sh   (runs the already-built df3460_harness)",
  "code_hash": "036cdb268a1823e08da6d1cf700704047c353baa2757deb950b21126e5f048a5",
  "notes": "Latent for rssadapt on this guest (optional module, no radio). The amrr twin (ieee80211_amrr.c:135/:390-417) is the DEFAULT ratectl and reachable on WiFi-equipped systems \u2014 flagged for ieee80211_amrr.cs owner (DF-3454 there is a different defect). DF-2975 documented the accept-filter registry analogue. Guest /usr/src restored to pristine after module fix-build (sha256 verified).",
  "recommended_fix": "rssadapt_deinit: free only if non-NULL and clear vap->iv_rs; rssadapt_sysctl_interval: return ENXIO when iv_rs == NULL \u2014 and mirror both one-liners in ieee80211_amrr.c \u2014 see findings/poc/DF-3460/fix.diff.",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applies cleanly (git apply --check on the guests /usr/src); the patched wlan_rssadapt module rebuilds with full kernel -Werror CFLAGS (rc=0, fix_module_build.log); harness fixed-mode shows the handler refusing (ENXIO) during the teardown window with no freed-chunk read or write (run.fixed.log).",
  "fix_evidence": [
    "findings/poc/DF-3460/fix.diff",
    "findings/poc/DF-3460/fix_module_build.log",
    "findings/poc/DF-3460/run.fixed.log"
  ]
}