{
  "finding_id": "DF-3637",
  "title": "ath_tx_start() swallows ath_tx_normal_setup() failure: leaked ath_buf + descriptor slab, phantom TIM",
  "verdict": "not_reproduced (hardware absent) / source-level confirmed 8/8",
  "impact_class": "resource-exhaustion DoS (Low)",
  "reproduce": {
    "build": "python3 findings/poc/DF-3637/verify_df3637.py --help (none needed; static analysis)",
    "run": "sh findings/poc/DF-3637/run.sh",
    "expected": "8x [PASS] then 'DF-3637 CONFIRMED at source level' (see run.log)"
  },
  "kernel_refs": ["sys/dev/netif/ath/ath/if_ath_tx.c:2021", "sys/dev/netif/ath/ath/if_ath_tx.c:2081", "sys/dev/netif/ath/ath/if_ath_tx.c:294", "sys/dev/netif/ath/ath/if_ath_tx.c:2407", "sys/dev/netif/ath/ath/if_ath.c:3813"],
  "artifacts": ["README.md", "VERDICT.md", "verify_df3637.py", "run.sh", "run.log", "env.txt", "fix.diff", "verdict.json", "manifest.json"]
}