=== run 1 ===
[UAF-WRITE] thread A wrote into a freed beacon mbuf (gen 220) -- freed by concurrent setup_beacon/vap_delete while A was inside ieee80211_beacon_update() with sc_mtx released (if_urtwn.c:2206-2212)
DF-5254 disjoint-lock-domain beacon mbuf race simulation
  update_beacon iterations (A) : 20603
  newstate re-entries     (B)   : 502
  vap_delete frees        (C)   : 3
  writes into freed mbuf        : 18104
  reads  of  freed mbuf (tx)    : 292
RESULT: USE-AFTER-FREE WRITE reproduced (freed gen 220)
The interleaving urtwn_update_beacon(if_urtwn.c:2206-2212) x {urtwn_setup_beacon(2168-2171) | urtwn_vap_delete(840-841)} is realizable: no lock orders A against B/C.
exit=3
=== run 2 ===
[UAF-WRITE] thread A wrote into a freed beacon mbuf (gen 184) -- freed by concurrent setup_beacon/vap_delete while A was inside ieee80211_beacon_update() with sc_mtx released (if_urtwn.c:2206-2212)
DF-5254 disjoint-lock-domain beacon mbuf race simulation
  update_beacon iterations (A) : 7797
  newstate re-entries     (B)   : 236
  vap_delete frees        (C)   : 1
  writes into freed mbuf        : 1117
  reads  of  freed mbuf (tx)    : 18
RESULT: USE-AFTER-FREE WRITE reproduced (freed gen 184)
The interleaving urtwn_update_beacon(if_urtwn.c:2206-2212) x {urtwn_setup_beacon(2168-2171) | urtwn_vap_delete(840-841)} is realizable: no lock orders A against B/C.
exit=3
=== run 3 ===
[UAF-WRITE] thread A wrote into a freed beacon mbuf (gen 186) -- freed by concurrent setup_beacon/vap_delete while A was inside ieee80211_beacon_update() with sc_mtx released (if_urtwn.c:2206-2212)
DF-5254 disjoint-lock-domain beacon mbuf race simulation
  update_beacon iterations (A) : 6318
  newstate re-entries     (B)   : 188
  vap_delete frees        (C)   : 1
  writes into freed mbuf        : 5828
  reads  of  freed mbuf (tx)    : 94
RESULT: USE-AFTER-FREE WRITE reproduced (freed gen 186)
The interleaving urtwn_update_beacon(if_urtwn.c:2206-2212) x {urtwn_setup_beacon(2168-2171) | urtwn_vap_delete(840-841)} is realizable: no lock orders A against B/C.
exit=3
=== run 4 ===
[UAF-WRITE] thread A wrote into a freed beacon mbuf (gen 404) -- freed by concurrent setup_beacon/vap_delete while A was inside ieee80211_beacon_update() with sc_mtx released (if_urtwn.c:2206-2212)
DF-5254 disjoint-lock-domain beacon mbuf race simulation
  update_beacon iterations (A) : 12321
  newstate re-entries     (B)   : 437
  vap_delete frees        (C)   : 2
  writes into freed mbuf        : 6200
  reads  of  freed mbuf (tx)    : 100
RESULT: USE-AFTER-FREE WRITE reproduced (freed gen 404)
The interleaving urtwn_update_beacon(if_urtwn.c:2206-2212) x {urtwn_setup_beacon(2168-2171) | urtwn_vap_delete(840-841)} is realizable: no lock orders A against B/C.
exit=3
=== run 5 ===
DF-5254 disjoint-lock-domain beacon mbuf race simulation
  update_beacon iterations (A) : 6728
  newstate re-entries     (B)   : 401
  vap_delete frees        (C)   : 1
  writes into freed mbuf        : 1
  reads  of  freed mbuf (tx)    : 0
RESULT: USE-AFTER-FREE WRITE reproduced (freed gen 403)
The interleaving urtwn_update_beacon(if_urtwn.c:2206-2212) x {urtwn_setup_beacon(2168-2171) | urtwn_vap_delete(840-841)} is realizable: no lock orders A against B/C.
[UAF-WRITE] thread A wrote into a freed beacon mbuf (gen 403) -- freed by concurrent setup_beacon/vap_delete while A was inside ieee80211_beacon_update() with sc_mtx released (if_urtwn.c:2206-2212)
exit=3