# DF-3617 — VERDICT

**Status: inconclusive** (NULL-deref/panic class defect proven from source;
cannot execute on a guest with no Atheros NIC)

## Reproduced?
No. The defect fires from `ath_intr()` on HAL_INT_SWBA, which requires the
wireless hardware to raise a software-beacon-alert interrupt. The guest has
no ath device (env.txt: no ath PCI id, no dev.ath sysctl, if_ath.ko present
but unloaded), so no SWBA can ever arrive. No amount of userland
construction on this guest reaches the code.

## Why the defect is certain anyway
- The dereferences are unconditional in the TDMA SWBA branch
  (if_ath.c:2186-2190): `TAILQ_FIRST(&ic->ic_vaps)` result passed straight
  into `ath_tdma_beacon_send()` (which dereferences `ATH_VAP(vap)` →
  `avp->av_bcbuf`, if_ath_tdma.c:615ff) and then
  `vap->iv_tdma->tdma_bintval`.
- `iv_tdma` is non-NULL only for TDMA vaps
  (sys/netproto/802_11/wlan/ieee80211_tdma.c:197 sets it in
  ieee80211_tdma_vattach; :211 clears it at detach; every other vap type
  leaves it NULL).
- `sc->sc_tdma` outlives the TDMA vap: ath_vap_delete clears it only when
  `sc->sc_nvaps == 0` (if_ath.c:1855-1858). Delete the TDMA vap while any
  sibling vap remains → sc_tdma==1 with a non-TDMA (iv_tdma==NULL) vap at
  the head of ic_vaps → guaranteed NULL deref on the next SWBA. This path
  needs no timing luck, only vap create/destroy ordering (admin-triggered;
  result is a kernel panic → local DoS).
- The teardown-race variant: ath_hal_intrset(ah,0) at if_ath.c:1785 does
  not stop an ISR already executing; SWBA processing at 2175+ holds no lock
  that ieee80211_vap_detach (1793) or sc_tdma=0 (1855) respects.

## Impact
NULL-deref panic in hard interrupt context (kernel DoS). Not memory
corruption (no wild write), no info leak. Requires admin-level vap
reconfiguration on a TDMA-configured ath interface to reach — hence Low.

## Fix
fix.diff: guard `vap == NULL || vap->iv_tdma == NULL` in the SWBA TDMA
branch (skip the beacon send, leave sc_tdmaswba at 0 so the next SWBA
retries). Companion (recommended, not in the minimal diff): clear sc_tdma
when the last *TDMA* vap is destroyed rather than when sc_nvaps hits 0 —
track it at if_ath.c:1840-1859 alongside sc_nstavaps.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.