[UAF-WRITE] thread A wrote into a freed beacon mbuf (gen 178) -- freed by concurrent setup_beacon/vap_delete while A was inside ieee80211_beacon_update() with sc_mtx released (if_urtwn.c:2206-2212)
DF-5254 disjoint-lock-domain beacon mbuf race simulation
  update_beacon iterations (A) : 5268
  newstate re-entries     (B)   : 205
  vap_delete frees        (C)   : 1
  writes into freed mbuf        : 62
  reads  of  freed mbuf (tx)    : 1
RESULT: USE-AFTER-FREE WRITE reproduced (freed gen 178)
The interleaving urtwn_update_beacon(if_urtwn.c:2206-2212) x {urtwn_setup_beacon(2168-2171) | urtwn_vap_delete(840-841)} is realizable: no lock orders A against B/C.
exit=3