{
  "finding_id": "DF-3593",
  "title": "Duplicate firmware TX-done re-completes a freed TX slot: KASSERT/NULL-deref panic and dr_usedslot underflow (bwn_dma_handle_txeof / bwn_pio_handle_txeof)",
  "verdict": "inconclusive",
  "impact": "panic",
  "reproduce": {
    "build": "sh probe.sh",
    "run": "as root on DF guest: sh probe.sh",
    "expected": "probe shows driver resident + no Broadcom hardware; on real BCM43xx hw with duplicate TX-done firmware behavior: instant kernel panic (KASSERT :5996 on INVARIANTS builds; NULL deref at :6012/:6052 otherwise)"
  },
  "kernel_refs": [
    "sys/dev/netif/bwn/bwn/if_bwn.c:5296",
    "sys/dev/netif/bwn/bwn/if_bwn.c:5308",
    "sys/dev/netif/bwn/bwn/if_bwn.c:5996",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6012",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6017",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6018",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6024",
    "sys/dev/netif/bwn/bwn/if_bwn.c:6052",
    "sys/dev/netif/bwn/bwn/if_bwn.c:7088",
    "sys/dev/netif/bwn/bwn/if_bwnreg.h:459"
  ],
  "artifacts": ["README.md", "VERDICT.md", "probe.sh", "run.log", "fix.diff", "manifest.json", "verdict.json"]
}