# DF-3473 - VERDICT

**status: inconclusive | reproduced: 0 | impact: none | confidence: certain**

Not testable to full effect on this guest (no 802.11 radio, so no 802.1x VAP can exist to hold iv_auth), but the guard-inertness half IS demonstrated: wlan_xauth.ko loads on the stock guest and kldunload wlan_xauth succeeds immediately and unconditionally - nrefs is provably never incremented because ieee80211_xauth.c:66-71 declares ia_attach/ia_detach NULL (net80211 only bumps nrefs inside ia_attach). Therefore any kldunload is permitted regardless of how many VAPs hold raw pointers into the module text (vap->iv_auth) - the unload-while-armed UAF is code-certain on hardware but cannot be armed on this rig. Arming needs root twice (802.1x VAP up + kldunload); the dangling dereference is then triggerable by an unauthenticated peer via association events. Ceiling: kernel panic (UAF read / call into freed module pages).

## Kernel references
- sys/netproto/802_11/wlan_xauth/ieee80211_xauth.c:66
- sys/netproto/802_11/wlan_xauth/ieee80211_xauth.c:71

## Evidence
run.log (kldload/kldunload transcript), source excerpt ieee80211_xauth.c:62-78

## Recommended fix
implement ia_attach/ia_detach that maintain nrefs (and refuse unload while referenced).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.