# DF-3579 — VERDICT

**Status: untested.** No runtime reproduction possible: the bug needs an iwn
device and either malicious firmware or an aggregation-teardown race; the
audit guest is virtio-only with no Intel WiFi hardware.

## Analysis (source-certain, trigger-speculative)

The dispatch chain is:
- `iwn_notif_intr()` (if_iwn.c:3934-3937) → `ops->tx_done`
- `iwn4965_tx_done()` if_iwn.c:3587-3606 / `iwn5000_tx_done()` if_iwn.c:3617-3641:
  `qid = desc->qid & 0xf` (bounded 0..15 — in range for both 16- and
  20-queue variants, so *this* index is safe), then for
  `qid >= sc->firstaggqueue` → `iwn_ampdu_tx_done(sc, qid, ...)`.
- `iwn_ampdu_tx_done()` if_iwn.c:3765-3768 dereferences `sc->qid2tap[qid]`
  (`tap->txa_tid`, `tap->txa_ni`) with no NULL check.

`qid2tap[qid]` lifetimes: set only in `iwn_addba_request` (if_iwn.c:7440);
cleared in `iwn_addba_response` failure (7463), `iwn_ampdu_tx_stop` (7532),
`iwn_rx_compressed_ba` (3303) and `iwn_ampdu_tx_done` (3874) — after which
the queue is a plain queue again, yet a firmware TX_DONE stamped with that
qid (>= firstaggqueue) would still be routed into `iwn_ampdu_tx_done` and
NULL-deref. With benign firmware this requires a stale completion racing the
teardown (the stop path waits for `queued == 0`, so the window is narrow);
with hostile/compromised firmware (the driver's stated trust boundary, same
model as DF-1122) it is a trivially forgeable notification.

Consequences: NULL pointer read at `tap->txa_tid` → kernel panic (DoS).
No memory-corruption primitive (the deref is a read of a NULL-adjacent
fixed offset).

Confidence: *likely* (code path certain; trigger needs malicious firmware
or a race that benign firmware makes unlikely).

## Recommendation

Apply fix.diff (bound + NULL check at the top of `iwn_ampdu_tx_done`). The
same guard pattern should be applied to `iwn_rx_compressed_ba` as part of
the DF-1122 fix.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.