{
  "finding_id": "DF-5263",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "mtw_key_set() defers the RAW struct ieee80211_key pointer k (if_mtw.c:1940). For pairwise keys net80211 embeds the key in the ieee80211_node (node-embedded key table), so if the node is freed (disassoc/deauth/reassociation churn) before the cmdq task executes, mtw_key_set_cb() dereferences freed memory: k->wk_cipher->ic_cipher (1965), k->wk_flags (1995), k->wk_key contents written to the device (2004-2010) - leaking freed heap to the USB device - and k->wk_pad = wcid WRITES into the freed node (2062). mtw_key_delete() deliberately copies the key into cmdq->key for exactly this reason (2114-2129); mtw_key_set forgot. Twin of DF-5250 (if_run). Simulated: 898/898 deferred key callbacks executed read+write on a freed node-embedded key. Hardware-gated in-kernel.",
  "exploit_chain": "4-way handshake completes (wpa) -> key queued -> node replaced/freed (reassoc, vap teardown racing) -> mtw_key_set_cb reads cipher/keylen from freed node and writes wk_pad -> UAF read (freed heap bytes DMAd to device) + UAF write into freed node",
  "evidence": "run.log: mtw_key_set_cb on freed node-embedded key hits: 898 (read + wk_pad write); cmdq_race.c key mode",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_mtw.c:1940",
    "sys/bus/u4b/wlan/if_mtw.c:1965",
    "sys/bus/u4b/wlan/if_mtw.c:2062",
    "sys/bus/u4b/wlan/if_mtw.c:2125"
  ],
  "poc_changes": "Harness written from scratch (same cmdq_race binary, key mode)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -pthread -o /tmp/cmdq_race /tmp/cmdq_race.c",
  "run_cmd": "/tmp/cmdq_race key 3",
  "code_hash": "9997d04b7584e57305ce06921e35591578869ac43b0808b92deff5a98f138197",
  "notes": "All mtw(4) paths are hardware-gated on the QEMU guest (no USB controller is passed through and no MT7601U device model exists); evidence is in-kernel structural (DF-5258: kld probe against the real if_mtwvar.h) or userland interleaving simulation mirroring the exact code regions/lock domains, per the wlan-trio pass-2 methodology (cf. DF-5246..DF-5257).",
  "recommended_fix": "Copy the ieee80211_key into cmdq->key (as mtw_key_delete already does) instead of deferring the raw pointer",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}