{
  "finding_id": "DF-3579",
  "title": "NULL qid2tap deref in iwn_ampdu_tx_done via TX_DONE on unbound aggregation queue",
  "verdict": "untested (no iwn hardware on guest); source-certain path, likely trigger",
  "impact": "panic (firmware-triggered DoS)",
  "reproduce": null,
  "kernel_refs": [
    "sys/dev/netif/iwn/if_iwn.c:3600",
    "sys/dev/netif/iwn/if_iwn.c:3765",
    "sys/dev/netif/iwn/if_iwn.c:3766",
    "sys/dev/netif/iwn/if_iwn.c:7532"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "verdict.json", "manifest.json"]
}