{
  "finding_id": "DF-3751",
  "title": "rt2860: ((struct rt2860_node *)ni)->wcid read from nodes allocated as plain ieee80211_node (missing ic_node_alloc)",
  "verdict": "not_reproduced (guest lacks Ralink hardware; OOB read source-certain, MMIO-only impact)",
  "impact_class": "kernel heap OOB read (1 byte) feeding MMIO index",
  "reproduce": {
    "precondition": "ral(4) + 802.11n BA session (ampdu_rx_start/stop callbacks)",
    "steps": ["associate with HT", "start/stop a Block Ack session -> rn->wcid read past node allocation -> MMIO RMW at WCID_ENTRY(garbage)+4"],
    "expected": "no crash; wrong WCID attribute word modified; byte read never disclosed"
  },
  "kernel_refs": ["sys/dev/netif/ral/rt2860.c:919", "sys/dev/netif/ral/rt2860.c:934", "sys/dev/netif/ral/rt2860.c:353", "sys/dev/netif/ral/rt2860var.h:102", "sys/netproto/802_11/wlan/ieee80211_node.c:917"],
  "artifacts": ["README.md", "fix.diff", "verdict.json", "env.txt", "manifest.json"]
}