{
  "finding_id": "DF-3638",
  "title": "ath_tx_retry_clone() error path: node-reference leak and recycled buffer with dangling bf_m",
  "verdict": "not_reproduced (hardware absent) / source-level confirmed 8/8",
  "impact_class": "memory/station-slot leak, latent UAF pointer (Low)",
  "reproduce": {
    "build": "python3 findings/poc/DF-3638/verify_df3638.py --help (none needed; static analysis)",
    "run": "sh findings/poc/DF-3638/run.sh",
    "expected": "8x [PASS] then 'DF-3638 CONFIRMED at source level' (see run.log)"
  },
  "kernel_refs": ["sys/dev/netif/ath/ath/if_ath_tx.c:4568", "sys/dev/netif/ath/ath/if_ath_tx.c:4579", "sys/dev/netif/ath/ath/if_ath_tx.c:294", "sys/dev/netif/ath/ath/if_ath.c:3170", "sys/dev/netif/ath/ath/if_ath.c:3080"],
  "artifacts": ["README.md", "VERDICT.md", "verify_df3638.py", "run.sh", "run.log", "env.txt", "fix.diff", "verdict.json", "manifest.json"]
}