{
  "finding_id": "DF-5262",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "All cmdq producers (mtw_key_set 1935-1941, mtw_update_beacon 3862-3866, mtw_newassoc 2380-2386, mtw_tx 3211-3215, mtw_updateslot 4124-4128, mtw_updateprot 3926-3930, tx-timeout 2887-2892) run WITHOUT MTW_LOCK (the comment at if_mtw.c:131-134 says the lock cannot be used because of a LOR with the node lock) and store cmdq[i].func FIRST, the args (arg0/arg1/k/mac) AFTER, with no memory barrier. mtw_cmdq_cb() (920-947) concurrently reads func and the args under MTW_LOCK - a lock that excludes nothing the producers do - and executes func(arg0) or func(&cmdq[i]) as soon as func != NULL. If the consumer observes the func store before the arg stores, the callback runs with the PREVIOUS entrys pointers in that slot (16-slot ring, MTW_CMDQ_MAX=16, wraps every 16 enqueues); mtw_key_set_cb would then fetch vap/k from an unrelated prior entry (type confusion), and a slow consumer additionally lets MTW_CMDQ_GET() wrap onto entries still awaiting execution, overwriting their args mid-flight. Simulated on the guest with the exact store/read order: 748510 torn states observed by a cmdq_cb-order reader in 3s, and a forced preemption between the two stores makes the consumer execute the callback with the stale freed vap/key (including the k->wk_pad write). In-kernel reproduction hardware-gated.",
  "exploit_chain": "two cmdq producers racing the cmdq task -> consumer sees func!=NULL with previous slots arg1/k -> mtw_key_set_cb(vap=old, k=old) reads k->wk_cipher->ic_cipher and writes k->wk_pad in an unrelated (possibly freed) key/vap -> type-confused callback on stale pointers",
  "evidence": "run.log: torn publishes observed ... : 748510 + deterministic torn run: callback executed on stale freed vap/key: YES (key wk_pad write happened: YES); cmdq_race.c torn mode",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_mtw.c:1937",
    "sys/bus/u4b/wlan/if_mtw.c:3864",
    "sys/bus/u4b/wlan/if_mtw.c:927",
    "sys/bus/u4b/wlan/if_mtw.c:936",
    "sys/bus/u4b/wlan/if_mtw.c:135",
    "sys/bus/u4b/wlan/if_mtwvar.h:279"
  ],
  "poc_changes": "Harness written from scratch; observer thread polls in mtw_cmdq_cbs read order; deterministic section forces the preemption point",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o /tmp/cmdq_race /tmp/cmdq_race.c",
  "run_cmd": "/tmp/cmdq_race torn 3",
  "code_hash": "9997d04b7584e57305ce06921e35591578869ac43b0808b92deff5a98f138197",
  "notes": "All mtw(4) paths are hardware-gated on the QEMU guest (no USB controller is passed through and no MT7601U device model exists); evidence is in-kernel structural (DF-5258: kld probe against the real if_mtwvar.h) or userland interleaving simulation mirroring the exact code regions/lock domains, per the wlan-trio pass-2 methodology (cf. DF-5246..DF-5257).",
  "recommended_fix": "Populate arg0/arg1/k first, then a write barrier (cpu_sfence), then publish .func last (all producer sites)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}