{
  "finding_id": "DF-3751",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The driver declares struct rt2860_node { struct ieee80211_node ni; uint8_t wcid; ... } (rt2860var.h:102-107) and reads ((struct rt2860_node *)ni)->wcid in the live AMPDU callbacks rt2860_ampdu_rx_start (rt2860.c:919) and rt2860_ampdu_rx_stop (rt2860.c:934) -- and in the compiled-out HW_CRYPTO key paths (rt2860.c:3266/3349; HW_CRYPTO is never defined anywhere in the tree) -- but never installs an ic_node_alloc override (no node_alloc in the file; attach hooks only ic_node_free at rt2860.c:353). net80211s generic node_alloc allocates exactly sizeof(struct ieee80211_node) (wlan/ieee80211_node.c:917-923), so the wcid load reads one byte past the end of the heap object; the value (allocator padding / adjacent slab bytes) then indexes MMIO RT2860_WCID_ENTRY(wcid)+4 (0x1800+8*wcid+4 <= 0x1ffc -- inside the register aperture, so no kernel-RAM write). Impact: an out-of-bounds read feeding a wrong-hardware-register RMW for every BA session start/stop; the byte read is not disclosed to the attacker. Certain at source level, low impact. Not reproduced: guest has no Ralink NIC (env.txt).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (alloc-site proof), fix.diff (adds rt2860_node_alloc + sets rn->wcid in newassoc; git apply --check passes)",
  "kernel_refs": [
    "sys/dev/netif/ral/rt2860.c:919",
    "sys/dev/netif/ral/rt2860.c:934",
    "sys/dev/netif/ral/rt2860.c:3266",
    "sys/dev/netif/ral/rt2860.c:3349",
    "sys/dev/netif/ral/rt2860.c:353",
    "sys/dev/netif/ral/rt2860var.h:102",
    "sys/netproto/802_11/wlan/ieee80211_node.c:917"
  ],
  "poc_changes": "Analysis-only; no runtime PoC possible without the NIC.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 8,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -lv | grep ralink",
  "code_hash": "",
  "notes": "The ampdu hooks are live code (IEEE80211_HT is defined in default builds). The ridx[]/ctl_ridx[] members of rt2860_node are dead. Missing-node_alloc is the upstream FreeBSD rt2860 shape as well; DFBSD audited as-is.",
  "recommended_fix": "Install ic_node_alloc = rt2860_node_alloc (kmalloc sizeof(struct rt2860_node)) and set ((struct rt2860_node *)ni)->wcid = wcid in rt2860_newassoc.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix restores the author-intended node layout (struct rt2860_node exists precisely for wcid); compile-consistent; runtime validation needs hardware.",
  "fix_evidence": "fix.diff (git apply --check passes against pristine sys/)"
}