# DF-3748 — rt2860 STA-mode AID→WCID truncation: OOB write of node pointer into `txq[0]` (remote, rogue-AP)

## Severity / class
High (remote-adjacent unauthenticated kernel heap OOB write; potential RCE-class primitive).
CWE-787 / CWE-125 / CWE-704 (integer truncation feeding array index).

## Reproduce
**Precondition: a machine with a Ralink RT2860/RT3xxx PCI(/e) card driven by `if_ral.ko`,
and an attacker-controlled 802.11 AP (hostapd with a patched AID allocator, or a raw
802.11 TX setup) in range of the victim.**

1. Victim: `kldload if_ral`, create `wlan0` in STA mode (`ifconfig wlan0 create wlandev ral0 mode 11ng`), scan.
2. Attacker AP: answer the victim's association request with an ASSOC/REASSOC Response
   whose AID field is `254` (0x00FE — a fully IEEE-legal AID; `0xC0FE` also works because
   net80211 only clears 0xC000).
3. Victim completes association → `rt2860_newassoc()` runs with `wcid = (uint8_t)(AID & 0x3fff) = 254`
   → `sc->wcid2ni[254] = ni;` writes **one entry past the 254-element array** (rt2860var.h:148),
   aliasing `&sc->txq[0].txd` (first member of the immediately-following `txq[6]`,
   rt2860var.h:150). The Tx ring-0 descriptor base pointer is replaced by a pointer to the
   live `ieee80211_node`.
4. Any subsequent data frame queued on AC BE (ring 0) makes `rt2860_tx()` write TX
   descriptors (`struct rt2860_txd`, 16 bytes: sdp0/sdl0/sdl1/sdp1/flags, rt2860reg.h:771-783)
   at `txq[0].txd[ring->cur]` = `node + cur*16`, `cur ∈ [0,63]` → ~1 KB of 16-byte-stride
   semi-controlled writes across the node and adjacent heap. Expect: immediate kernel
   panic on next TX (or, with grooming, controlled corruption — see VERDICT.md).

**Expected observation on hardware:** panic in `rt2860_tx` / net80211 rx path right after
association + first data frame; `txq[0].txd` != DMA block address.

## Status on this audit's guest
Guest `dfbsd 6.5-DEVELOPMENT (X86_64_GENERIC, Jul 2026)` has **no Ralink NIC**
(`pciconf -lv` shows none; interfaces: vtnet0 lo0) — runtime reproduction impossible.
`if_ral.ko` exists and `pci/ral` ids are registered, so the module is only one
`kldload` away on any machine with the hardware. Analysis is source-certain; see
VERDICT.md for the line-by-line proof.