{
  "finding_id": "DF-3595",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Source-certain error-path lifetime bug: bwn_switch_band (if_bwn.c:4764) and bwn_hwreset (if_bwn.c:5365) set sc->sc_curmac=NULL on re-init failure while BWN_FLAG_RUNNING stays set and callers ignore the error; the next bwn_stop (if_bwn.c:2048 \u2014 from bwn_parent :910, bwn_suspend :7374, bwn_detach :791-794) dereferences the NULL mac and panics. Driver already guards mac==NULL on the TX path (if_bwn.c:949) but not on stop/detach/suspend. Guest has no Broadcom device (run.log) so the up\u2192band-switch-fail\u2192down sequence cannot run; trigger requires fw re-load failure (missing firmware after first load, flaky or malicious card).",
  "exploit_chain": "",
  "evidence": "VERDICT.md path:line trace; run.log guest probe; fix.diff adds NULL guard clearing RUNNING in bwn_stop",
  "kernel_refs": [
    "sys/dev/netif/bwn/bwn/if_bwn.c:4764",
    "sys/dev/netif/bwn/bwn/if_bwn.c:5365",
    "sys/dev/netif/bwn/bwn/if_bwn.c:2048",
    "sys/dev/netif/bwn/bwn/if_bwn.c:791"
  ],
  "poc_changes": "No runnable PoC possible without hardware; probe.sh substitutes",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (X86_64_GENERIC, INVARIANTS)",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level; probe.sh only)",
  "run_cmd": "vm.sh run_root sh probe.sh",
  "code_hash": "1dd0c720eadc950b8900406eb0ca725b8ba6f8b9f6969a1e3214900e2a1dc703",
  "notes": "bwn_detach also calls bwn_dma_free(mac) at if_bwn.c:795 with the NULL mac for attached devices \u2014 same family; the bwn_stop guard in fix.diff is the minimal fix.",
  "recommended_fix": "NULL-guard sc_curmac in bwn_stop (clear BWN_FLAG_RUNNING and return)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/; cannot baseline-validate without BCM43xx hardware",
  "fix_evidence": "fix.diff in this pack"
}