# DF-4762 — fwe_stop() RX teardown races fwohci_rbuf_update()/fwe_as_input(): kfree(bulkxfer) + m_freem() while chunks are still being queued/walked → UAF write/read + mbuf double-free

File: `sys/dev/netif/fwe/if_fwe.c` (pass 2). Related: `sys/bus/firewire/fwohci.c`.

## Build / Run / Expected

```
build.sh   # cc -O -o fwe_trigger fwe_trigger.c     (on the audit guest)
run.sh     # as root: probe fwe0 + document the ifconfig-down race driver
```

On hardware with an OHCI-1394 controller (`fwohci0` → `fwe0`), the full
reproducer is:

1. Peer node streams isochronous packets on the fwe stream channel
   (default `hw.firewire.fwe.stream_ch=1`), e.g. another machine doing
   IP-over-FireWire traffic to us.
2. Root loop: `while :; do ifconfig fwe0 up; ifconfig fwe0 down; done`.
3. Expected on a vulnerable kernel: panic (page fault in `fwe_as_input`
   walking a freed `bulkxfer` chunk, or `m_freem()` double-free of an
   mbuf cluster freed by `fwe_stop`) within seconds-to-minutes of racing.

On the audit QEMU guest there is **no FireWire controller** (QEMU has no
OHCI-1394 device model at all), so `fwe0` cannot exist — see `run.log`
(exit 2, "Device not configured") and `env.txt`. Runtime verification is
therefore blocked by absent hardware; the pack carries the full
source-level proof instead (VERDICT.md).

## Verdict (see VERDICT.md, verdict.json)

Not runtime-testable on this guest (hardware absent). Source-level
analysis: certain race window, no common lock across the freed state;
severity Medium (admin-triggered teardown racing remote peer traffic;
kernel memory corruption when hit).