{
  "finding_id": "DF-5264",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "On stop, mtw_stop() (if_mtw.c:4626-4713) drains mbufq and rx_m but never touches the six sc_epq[] rings; FreeBSDs run_stop() frees the TX pool (free TX pool (should be empty) loop in if_run.c). On the next up, mtw_init_locked() (4463-4467) calls mtw_setup_tx_list() for every queue, whose first act is memset(pq, 0, sizeof(*pq)) (950-954) - silently orphaning any tx_data[].m mbufs and leaking their tx_data[].ni node references. After a down with frames queued (ring holds up to 6x32 entries), up to ~192 mbuf clusters plus node references are leaked per cycle; leaked node references keep ieee80211_node allocations pinned forever (the node-table purge decrements but never reaches zero), so each down/up cycle under load permanently loses kernel memory. Repeatable by any admin (ifconfig wlanX down/up) with traffic in flight; unprivileged users merely need to keep the ring non-empty while root cycles the interface. Twin of DF-5251/DF-5255.",
  "exploit_chain": "traffic fills tx rings -> ifconfig down (mtw_stop leaves rings) -> ifconfig up (setup_tx_list memsets) -> mbuf clusters + node refs leaked -> repeat -> kernel memory exhaustion over time",
  "evidence": "Code-cited analysis; VERDICT.md walks mtw_stop -> mtw_init_locked -> mtw_setup_tx_list memset. No guest run (hardware-gated): untested",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_mtw.c:4647",
    "sys/bus/u4b/wlan/if_mtw.c:4466",
    "sys/bus/u4b/wlan/if_mtw.c:954",
    "sys/bus/u4b/wlan/if_mtw.c:968"
  ],
  "poc_changes": "",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a (static analysis)",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "All mtw(4) paths are hardware-gated on the QEMU guest (no USB controller is passed through and no MT7601U device model exists); evidence is in-kernel structural (DF-5258: kld probe against the real if_mtwvar.h) or userland interleaving simulation mirroring the exact code regions/lock domains, per the wlan-trio pass-2 methodology (cf. DF-5246..DF-5257).",
  "recommended_fix": "Call mtw_unsetup_tx_list() for all MTW_EP_QUEUES in mtw_stop() before the next init memsets them",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}