{
  "finding_id": "DF-3971",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain resource leak: rt2560_tx_bcn (rt2560.c:1546-1547) unconditionally overwrites the single beacon-ring slot (RT2560_BEACON_RING_COUNT==1, rt2560reg.h:26) without freeing its previous mbuf/ni occupants, and rt2560_newstate (rt2560.c:811-824) re-enters this path on every transition to IEEE80211_S_RUN. Re-RUN without an interface stop is a normal remotely-drivable event in IBSS mode: any on-channel peer beacon with greater TSF forces ieee80211_ibss_merge (ieee80211_node.c:610-637) -> ieee80211_sta_join1 -> ieee80211_new_state(vap, S_RUN, -1) for non-STA opmodes, leaking ~2KB of mbuf cluster plus one ieee80211_node reference per merge; the tx_bcn error path additionally leaks the ref_node taken at rt2560.c:820. Pure leak (with RING_COUNT==1 there is no slot aliasing/double-free \u2014 that variant was analyzed and killed); unbounded kernel memory growth, no corruption. Not reproduced: no Ralink NIC on the guest (env.txt); IBSS-merge leak pump recipe in trigger.c.",
  "exploit_chain": "admin brings up ral0 adhoc vap -> remote peer rotates adhoc BSSIDs with increasing TSF on same channel/SSID -> each ibss merge re-enters S_RUN while ic_nrunning stays >0 (no stop/reset) -> rt2560_tx_bcn overwrites slot 0 -> old beacon mbuf + node ref leaked -> unbounded kernel memory growth (netstat -m climb).",
  "evidence": "VERDICT.md (full leak chain with path:line, incl. the killed double-free variant), trigger.c (on-target recipe), env.txt, fix.diff (stale-slot cleanup guarded by data->m != m0 / data->ni != ni + error-path ref drop), build.log (if_ral.ko rebuilt -Werror clean on the guest /usr/src copy)",
  "kernel_refs": [
    "sys/dev/netif/ral/rt2560.c:811",
    "sys/dev/netif/ral/rt2560.c:820",
    "sys/dev/netif/ral/rt2560.c:1546",
    "sys/dev/netif/ral/rt2560reg.h:26",
    "sys/netproto/802_11/wlan/ieee80211_node.c:610",
    "sys/netproto/802_11/wlan/ieee80211_node.c:427"
  ],
  "poc_changes": "Trigger is a documented IBSS-merge pump recipe (needs two radios); informational C stub compiled only.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /usr/src && patch -p1 < /root/fix3.diff && cd sys/dev/netif/ral && make   # -Werror, full if_ral.ko link (build.log)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -lv | grep -i ralink; ifconfig -l   # => no Ralink device (run.log/env.txt)",
  "code_hash": "74ec773c711544ebb66a5d4fa8269590d75cd3877348fd5f8f96620bffe6e8d6e",
  "notes": "Pass-2 finding (GLM 5.3). FreeBSD-inherited. Leak-only; IBSS/hostap must be admin-configured first; requires RF proximity to pump.",
  "recommended_fix": "Free stale beacon-slot occupants in rt2560_tx_bcn before storing (guarded against the beacon_expire same-mbuf reload) and drop the leaked ref on the tx_bcn error path (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Stale-slot cleanup (guarded by data->m != m0 / data->ni != ni so the beacon_expire reload of the same mbuf is untouched) + error-path ieee80211_free_node(ni); git apply --check clean against sys/ and the patched module rebuilt -Werror clean (build.log; combined with the other two rt2560 fix.diffs of this batch). Runtime validation impossible without the NIC.",
  "fix_evidence": "fix.diff; build.log (if_ral.ko linked from patched rt2560.o with -Werror on the guest /usr/src copy)"
}