{
  "finding_id": "DF-4893",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "The AH_DEBUG_ALQ block of ah_osdep.c contains a certain-by-inspection TOCTOU on the module-global `struct alq *ath_hal_alq`: unlocked consumers (`if (ath_hal_alq)` at ah_osdep.c:297/:336/:353, then alq_get/alq_post via ath_hal_alq_get :258-280) race the sysctl disable path (`alq_close(ath_hal_alq); ath_hal_alq = NULL;` at :230-232, no lock), yielding a use-after-free write if ever compiled. It is unreachable on any stock DragonFly build, proven three ways: (1) the option mapping is commented out at sys/conf/options:551 so config(8) cannot enable AH_DEBUG_ALQ; (2) the TU cannot compile even if force-defined - no <sys/alq.h>/alq(9) exists anywhere in the tree (include commented out at ah_osdep.c:202) and ALQ-branch ath_hal_reg_read (:324) calls ath_hal_reg_whilst_asleep(), defined only under AH_DEBUG (:153-171); (3) on the audit guest (ath compiled into GENERIC, hw.ath.* live) the ALQ sysctls are absent at runtime (`sysctl hw.ath.hal.alq` -> unknown oid, root and uid=1001 alike) and there is zero Atheros hardware (pciconf count 0). Probe trigger built and run on the guest: TARGET ABSENT, exit 3 (run.log). Filed as Info/latent so the race is on record before anyone imports alq(9) and flips the option on wholesale; even upstream on FreeBSD the trigger requires root to toggle the sysctl concurrent with register traffic.",
  "exploit_chain": "",
  "evidence": "run.log (guest: BUILD_OK; hw.ath.hal.alq/alq_logfile ABSENT; trigger_rc=3; static: #AH_DEBUG_ALQ opt_ah.h at sys/conf/options:551; sys/alq.h ABSENT; 0 ath/AMD PCI devices); run.2.log (first probe incl. unknown-oid sysctl session); sysctl_proof.txt; env.txt (uname, cc 8.3); VERDICT.md (full path:line narrative); fix.diff (delete the dead block)",
  "kernel_refs": [
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:188-364",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:202",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:216-256",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:258-280",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:297-307",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:316-348",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:324",
    "sys/dev/netif/ath/ath_hal/ah_osdep.c:350-364",
    "sys/conf/options:551"
  ],
  "poc_changes": "No seed PoC existed. Authored documentary probe trigger.c (precondition checker for the sysctl oid / alq.h / option mapping) plus run.sh; compiled and executed on the guest; fixed one missing <unistd.h> include found by the guest compiler.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 42,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -Wextra -o trigger trigger.c (guest /tmp/df4893)",
  "run_cmd": "./trigger  (exit 3 = TARGET ABSENT; see run.sh)",
  "code_hash": "f510f751a9178dc28aa251b159fb498962b9ed3b7be7e591c7a8cb6a641f3a82",
  "notes": "Latent-only: triple-dead on stock DF (option commented out; no alq(9) in tree; AH_DEBUG-only helper referenced). Guest left clean (/tmp/df4893 removed, no module loads, no panic). ni_dma.c co-audit in the same batch returned clean (verbatim Linux v4.4 import, byte-diff = one removed forward declaration; Linux master 2026 still differs from v4.4 only by include reshuffle, i.e. zero upstream fixes since import; family defects DF-4870/4871 live in r600_dma.c, ignored-sync twins at evergreen_dma.c:130-131 / rv770_dma.c:66-67 / si_dma.c:255-256 belong to those files rows).",
  "recommended_fix": "Delete the dead AH_DEBUG_ALQ block (or, if alq(9) is ever imported, guard `ath_hal_alq` with a mutex on both consumer and sysctl-closer paths and fix the ath_hal_reg_whilst_asleep AH_DEBUG guard); see fix.diff",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not applicable - nothing reproduced on any build (the defect is compiled out of every stock kernel), so there is no bad behavior to validate a fix against. fix.diff is a source-level hardening deletion authored from line-accurate analysis; not applied to sys/ per audit rules.",
  "fix_evidence": "fix.diff; VERDICT.md Baseline vs fix validation section"
}