{
  "finding_id": "DF-5246",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Proven-by-lock-analysis use-after-free: run_update_beacon() (if_run.c:4887-4892) touches rvp->beacon_mbuf under only the net80211 ic lock, while run_newstate() (2105-2106) and run_vap_delete() (1013-1014) free the same mbuf under only the driver sc lock - the lock sets are disjoint, so ieee80211_beacon_update() writes seq/capinfo/TIM (and on CSA a full beacon rewrite) into a freed mbuf cluster. Simulated on the guest with a harness that mirrors the exact code regions and lock domains: 343k-444k write-after-free interleavings per 10 s run (~0.35% of beacon updates). In-kernel reproduction is hardware-gated (no run(4) adapter can be attached to the QEMU guest), hence inconclusive.",
  "exploit_chain": "hostap/ibss vap + power-save client TIM churn (remote peer triggerable) racing a RUN->INIT transition or ifconfig destroy -> ieee80211_beacon_update writes into freed 2KB mbuf cluster -> heap corruption; CSA path gives a large structured overwrite -> panic to potential privesc with post-free reallocation control",
  "evidence": "findings/poc/DF-5246/run.log lines UAF hits: 343159/383831/443967 across 3 runs; VERDICT.md lock-intersection table; if_run.c:2067-2068 (ic lock dropped) vs ieee80211_power.c:310-316 (set_tim under ic lock)",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_run.c:4861",
    "sys/bus/u4b/wlan/if_run.c:4887",
    "sys/bus/u4b/wlan/if_run.c:4892",
    "sys/bus/u4b/wlan/if_run.c:2105",
    "sys/bus/u4b/wlan/if_run.c:1013",
    "sys/netproto/802_11/wlan/ieee80211_power.c:316",
    "sys/netproto/802_11/ieee80211_dragonfly.h:598"
  ],
  "poc_changes": "Harness written from scratch (no seed): pthread mutexes model IEEE80211_LOCK(ic) and RUN_LOCK(sc); free() poisons via a live flag so the process survives while counting kernel-equivalent UAF writes",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 47,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o /tmp/beacon_race /tmp/beacon_race.c",
  "run_cmd": "/tmp/beacon_race 10   (3 runs, see run.sh)",
  "code_hash": "0e0f37cdcf7e278741cffb492d5fb508b2d7c65de44061b2e06d0a824b8ebf6d",
  "notes": "Simulation only - the kernel path needs a real Ralink run(4) USB adapter (hostap mode). Guest has if_run.ko loadable but no USB controller/device (usbconfig: none), and QEMU has no RT2870 device model, so vendor control requests cannot be emulated via usb-storage.",
  "recommended_fix": "Take RUN_LOCK around the beacon_mbuf check/alloc/use in run_update_beacon()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the QEMU guest has no USB controller and no run(4) device model exists, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}