{
  "finding_id": "DF-4734",
  "title": "ar5210_xmit: ar5210ResetTxQueue dereferences ah_curchan (IEEE80211_IS_CHAN_TURBO) without the NULL guard both sibling HALs carry",
  "verdict": "untested-runtime (hardware-gated: no Atheros NIC on guest); fix build-validated BUILD_RC=0 -Werror",
  "impact": "latent NULL-deref kernel panic (DATA resetTxQueue before first channel set); in-tree call order protects",
  "reproduce": {
    "build": "cd /usr/src && patch -p1 < /tmp/df4734.diff && make nativekernel KERNCONF=X86_64_GENERIC",
    "run": "n/a (no Atheros NIC on guest; no userland-reachable caller)",
    "expected": "build-only: BUILD_RC=0, ar5210_xmit.c compiled -Werror"
  },
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:157",
    "sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:180",
    "sys/netproto/802_11/_ieee80211.h:268",
    "sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c",
    "sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "fix.diff",
    "build.sh",
    "build.log",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}