{
 "finding_id": "DF-3473",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Not testable to full effect on this guest (no 802.11 radio, so no 802.1x VAP can exist to hold iv_auth), but the guard-inertness half IS demonstrated: wlan_xauth.ko loads on the stock guest and kldunload wlan_xauth succeeds immediately and unconditionally - nrefs is provably never incremented because ieee80211_xauth.c:66-71 declares ia_attach/ia_detach NULL (net80211 only bumps nrefs inside ia_attach). Therefore any kldunload is permitted regardless of how many VAPs hold raw pointers into the module text (vap->iv_auth) - the unload-while-armed UAF is code-certain on hardware but cannot be armed on this rig. Arming needs root twice (802.1x VAP up + kldunload); the dangling dereference is then triggerable by an unauthenticated peer via association events. Ceiling: kernel panic (UAF read / call into freed module pages).",
 "evidence": "run.log (kldload/kldunload transcript), source excerpt ieee80211_xauth.c:62-78",
 "kernel_refs": [
  "sys/netproto/802_11/wlan_xauth/ieee80211_xauth.c:66",
  "sys/netproto/802_11/wlan_xauth/ieee80211_xauth.c:71"
 ],
 "poc_changes": "none (unload-guard demo only)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 20,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "kldload wlan_xauth; kldunload wlan_xauth  # succeeds with zero VAPs - guard inert",
 "code_hash": null,
 "notes": "fix_status: not_testable (no radio). The module itself is shipped in /boot/kernel.",
 "recommended_fix": "implement ia_attach/ia_detach that maintain nrefs (and refuse unload while referenced)."
}