# DF-3969 — rt2560_scan_end / rt2560_enable_tsf_sync dereference the vap unchecked → NULL-deref panic racing last-vap destroy (DF-3968 family)

**File:** sys/dev/netif/ral/rt2560.c (pass 2, GLM 5.3)

## What
`rt2560_scan_end` (2566–2574) dereferences `ic->ic_scan->ss_vap->iv_bss` and
`rt2560_enable_tsf_sync` (2274–2284) dereferences `TAILQ_FIRST(&ic->ic_vaps)->iv_bss`
with no NULL check. The scanner invokes `ic->ic_scan_end` **unlocked**
(ieee80211_scan_sw.c:796–798, self-annotated "scan state can change!"), while
`ieee80211_vap_delete → ieee80211_scan_vdetach` (ieee80211_scan.c:147–155)
clears `ss_vap` and empties `ic_vaps` under the COM lock. Destroying the only
vap inside that window ⇒ NULL deref ⇒ Fatal trap 12 (local DoS; destroy is
privileged). Identical pattern to DF-3968 on the rt2661 sibling; the rt2560
variant faults on whichever of the two derefs the race leaves stale.

## Build / Run
Hardware-gated (needs an RT2560 PCI NIC; this guest has none — env.txt):
  cc trigger.c        (informational)
  # on target: loop `ifconfig wlan0 destroy` against an active background scan

## Expected
`Fatal trap 12: page fault while in kernel mode` in `rt2560_enable_tsf_sync`
(read of `vap->iv_bss` with vap==NULL) or `rt2560_scan_end` (ss_vap==NULL).

## Fix validation
fix.diff adds NULL guards at both sites; `git apply --check` clean against
sys/, and applied to the guest's /usr/src copy where the full `if_ral.ko`
module rebuilt clean with `-Werror` (build.log).