{
  "finding_id": "DF-5260",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "mtw_update_beacon() queues {func=mtw_update_beacon_cb, arg0=vap} (if_mtw.c:3864-3865), mtw_newassoc() queues arg1=ni (2382-2386), mtw_key_set() queues arg1=vap (1937-1940), and the tx-timeout path queues arg0=vap (2887-2892) - all raw pointers into a 16-slot lockless ring consumed later by the cmdq task. mtw_vap_delete() (876-910) does ieee80211_vap_detach(vap) and kfree(rvp) at 909 with NO drain of sc->cmdq_task (ieee80211_draintask is only called from mtw_detach, 750-751), so any entry still pending when the vap is destroyed executes its callback on freed memory: mtw_update_beacon_cb dereferences vap->iv_bss (3876) and rvp->beacon_mbuf (3893-3898); mtw_newassoc_cb dereferences ni->ni_vap and ni->ni_macaddr (2340-2347) and indexes sc->wcid_stats[wcid]. Simulated on the guest: with the drivers exact queue/execute ordering, 898/898 queued beacon callbacks executed on a freed vap (every queued entry hits when vap_delete does not drain - the kernels taskqueue latency vs. destroy window). In-kernel reproduction hardware-gated.",
  "exploit_chain": "wpa/hostap activity queues cmdq entries -> ifconfig wlanX destroy immediately -> kfree(rvp) while cmdq_task pending -> mtw_update_beacon_cb reads vap->iv_bss, rvp->beacon_mbuf from freed 80211_VAP zone memory -> info leak into device writes (beacon content from freed heap) / crash; ni variant -> UAF read of node macaddr",
  "evidence": "run.log: mtw_update_beacon_cb on freed vap hits: 898 (898/898 hit rate); cmdq_race.c vap mode; VERDICT.md",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_mtw.c:3864",
    "sys/bus/u4b/wlan/if_mtw.c:2382",
    "sys/bus/u4b/wlan/if_mtw.c:1937",
    "sys/bus/u4b/wlan/if_mtw.c:2890",
    "sys/bus/u4b/wlan/if_mtw.c:909",
    "sys/bus/u4b/wlan/if_mtw.c:750"
  ],
  "poc_changes": "Harness written from scratch; consumer mirrors mtw_cmdq_cb (if_mtw.c:920-947) under a modelled MTW_LOCK; poison-flag instead of free so hits are countable",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o /tmp/cmdq_race /tmp/cmdq_race.c",
  "run_cmd": "/tmp/cmdq_race vap 3",
  "code_hash": "9997d04b7584e57305ce06921e35591578869ac43b0808b92deff5a98f138197",
  "notes": "All mtw(4) paths are hardware-gated on the QEMU guest (no USB controller is passed through and no MT7601U device model exists); evidence is in-kernel structural (DF-5258: kld probe against the real if_mtwvar.h) or userland interleaving simulation mirroring the exact code regions/lock domains, per the wlan-trio pass-2 methodology (cf. DF-5246..DF-5257).",
  "recommended_fix": "ieee80211_draintask(ic, &sc->cmdq_task) in mtw_vap_delete() before the vap is freed",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}