# DF-3968 — rt2661_scan_end / rt2661_enable_tsf_sync dereference `TAILQ_FIRST(&ic->ic_vaps)` unchecked → NULL-deref panic racing last-vap destroy

**File:** sys/dev/netif/ral/rt2661.c (pass 2)

## What
`rt2661_scan_end` (2839–2848) and `rt2661_enable_tsf_sync` (2743–2750) fetch
the first vap and dereference it (`vap->iv_bss->ni_bssid`,
`vap->iv_opmode`) without a NULL check. The scanner calls `ic_scan_end`
**unlocked** (ieee80211_scan_sw.c:797, with its own "scan state can change!"
warning), while `ieee80211_vap_delete → ieee80211_scan_vdetach`
(ieee80211_scan.c:140–155) removes the vap under the lock. Destroying the
only vap inside that window leaves `TAILQ_FIRST` NULL → Fatal trap 12.

## Build / Run
Hardware-gated (needs a Ralink NIC + association + background scan):
  cc trigger.c   (informational)
  # on target: loop `ifconfig wlan0 destroy` against an active bg-scan

## Expected
`Fatal trap 12: page fault while in kernel mode` at
`rt2661_scan_end+…` (read of vap->iv_bss with vap==NULL).