# DF-3618 — VERDICT

**Status: inconclusive** (author-acknowledged race; UAF-class; needs ath
hardware + SMP timing to fire; not executable on this guest)

## Reproduced?
No — and it cannot be reproduced here: ath_vap_delete requires an attached
ath vap; the guest has no Atheros NIC (env.txt). Beyond hardware, the
window needs an in-flight/queued taskqueue worker racing the second
ath_draintxq under TX load on SMP.

## Why this is filed anyway (pass-2 lifetime analysis)
The defect is acknowledged in the source itself (if_ath.c:1796-1810 "XXX
Danger Will Robinson! Danger! ... This may be racy - the ath task may be
running and the packet may be being scheduled between sw->hw txq."). The
audit-independent facts that make it a real lifetime bug and not just a
stale comment:

- Interrupts are disabled at 1785 but the driver never blocks/drains its
  own taskqueue in this path, unlike ath_reset (2889 + 3021) and
  ath_key_update_begin (3542) which deliberately do.
- A task already executing ath_tx_processq/ath_txq_sched_tasklet holds
  buffers whose completion path (bf_comp callbacks, ieee80211_tx_complete →
  ni->ni_vap) and whose queue linkage (avp->av_mcastq, drained at 1835
  without exclusion) reference memory kfreed at 1860.
- ieee80211_vap_detach (1793) provably queues a disassoc frame *after* the
  first drain — that frame is precisely what the second drain races.

Class: CWE-412/USE-AFTER-FREE window; exploitability speculative (needs
slab grooming during a destroy under load — admin-triggered entry, so
privilege bar is low value anyway).

## Fix validation
Not possible on this guest (no hardware). fix.diff is the minimal
taskqueue block+drain mitigation; the real fix is the upstream-style
rework of vap teardown ordering.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.