{
  "finding_id": "DF-3748",
  "title": "rt2860: STA-mode AID->WCID truncation writes ieee80211_node pointer past wcid2ni[] into txq[0] (remote OOB write via rogue AP)",
  "verdict": "not_reproduced (guest lacks Ralink hardware; source-certain)",
  "impact_class": "kernel heap OOB write, unauthenticated remote trigger (adjacent/802.11)",
  "reproduce": {
    "precondition": "host with RT2860/RT3xxx NIC + if_ral.ko; attacker-run 802.11 AP",
    "steps": [
      "victim: ifconfig wlan0 create wlandev ral0 mode 11ng; ifconfig wlan0 up scan",
      "attacker AP: respond to association with AID field = 254 (0x00FE or 0xC0FE)",
      "victim associates -> rt2860_newassoc writes wcid2ni[254]=ni == &txq[0].txd",
      "first data frame on AC-BE -> rt2860_tx writes 16-byte TXDs across the node -> panic"
    ],
    "expected": "kernel panic in rt2860_tx / net80211 immediately after association + first TX; txq[0].txd != DMA block"
  },
  "kernel_refs": [
    "sys/dev/netif/ral/rt2860.c:885",
    "sys/dev/netif/ral/rt2860.c:887",
    "sys/dev/netif/ral/rt2860.c:1587",
    "sys/dev/netif/ral/rt2860.c:1136",
    "sys/dev/netif/ral/rt2860var.h:148",
    "sys/netproto/802_11/wlan/ieee80211_sta.c:1688"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "verdict.json", "env.txt", "manifest.json"
  ]
}