# DF-3967 — rt2661_tx_intr: device-fed TX-status desync (qid garbage → mgtq, unguarded `queued--`, stat-cursor assumption) → mbuf UAF window / m leak

**File:** sys/dev/netif/ral/rt2661.c (pass 2, checklist item (b) TX ring indices)

## What
`rt2661_tx_intr` (896–960) attributes each device-posted TX result to
`txq->data[txq->stat]` — the *driver's* cursor — and trusts the device's qid
field (`(val>>8)&0xf`; qid 5..15 silently mapped to the mgt ring at 906).
`txq->queued--` (955) has no floor, so spurious results underflow `queued`
and defeat the ring-full gate at 1687 → the post path (1561–1562, 1643–1644)
overwrites slots the device still owns. A result landing on an in-flight slot
frees its mbuf via `ieee80211_tx_complete` (959) while the device may still
DMA it. The `ni == NULL` continue (916–917) drops `m` without freeing (leak).

Device-gated (malicious/buggy NIC firmware), same trust class as rt2860's
DF-3749 but a different mechanism (cursor desync vs. stale node map).

## Build / Run
Hardware-gated; see trigger.c (fw-patched NIC or PCIe emulation posting
spurious TX_STAT_VALID entries).