{
  "finding_id": "DF-3752",
  "title": "rt2860: uninitialized retrycnt passed to ratectl on TX_FAILURE (amrr consumes it unconditionally)",
  "verdict": "not_reproduced (guest lacks Ralink hardware; source-certain UB)",
  "impact_class": "uninitialized stack read corrupting rate-control state",
  "reproduce": {
    "precondition": "ral(4) TX to an unreachable/failed destination",
    "steps": ["TX frames that fail (no ACK) -> TX_STAT_FIFO !TXQ_OK -> else-branch passes uninit &retrycnt -> amrr_retrycnt += stack garbage"],
    "expected": "garbage retry counters in wlanstats (no crash)"
  },
  "kernel_refs": ["sys/dev/netif/ral/rt2860.c:1129", "sys/dev/netif/ral/rt2860.c:1160", "sys/netproto/802_11/wlan/ieee80211_amrr.c:364"],
  "artifacts": ["README.md", "fix.diff", "verdict.json", "env.txt", "manifest.json"]
}