{
  "finding_id": "DF-3618",
  "title": "ath_vap_delete second TX drain races live taskqueue workers before kfree(avp) - author-acknowledged UAF window",
  "verdict_summary": "Interrupts are disabled but the driver taskqueue is never blocked/drained in ath_vap_delete, unlike ath_reset/ath_key_update_begin; a queued/running TX task can hold vap references (av_mcastq, bf_comp callbacks) across kfree(avp). Speculative triggerability (SMP+TX load timing), hardware required, absent on guest.",
  "reproduce": {
    "build": "n/a - hardware vap-teardown race",
    "run": "on ath hardware, SMP, under TX load: repeated ifconfig wlanX destroy while traffic flows",
    "expected": "use-after-free of struct ath_vap (mcastq linkage/completion callbacks) -> panic"
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath/if_ath.c:1785",
    "sys/dev/netif/ath/ath/if_ath.c:1793",
    "sys/dev/netif/ath/ath/if_ath.c:1812",
    "sys/dev/netif/ath/ath/if_ath.c:1835",
    "sys/dev/netif/ath/ath/if_ath.c:1860"
  ],
  "artifacts": ["README.md", "VERDICT.md", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}