{
  "finding_id": "DF-5265",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "If usbd_transfer_setup() fails (if_mtw.c:539-547) mtw_attach() jumps to detach: at 692, which executes MTW_UNLOCK(sc) (693) although MTW_LOCK(sc) is first taken later, at 550 - releasing a lockmgr lock that was only MTW_LOCK_INITd (535). On DragonFly lockmgr an LK_RELEASE without ownership trips the lock-count assertions/underflow (lockmgr: lks not held/negative count) and panics or corrupts the lock state; mtw_detach() then also runs usb_callout_drain(&sc->ratectl_ch) (749) on a callout that is only usb_callout_init_mtxd on the success path (685). Reachable by any USB device whose descriptors make usbd_transfer_setup fail while matching the MTW_VP table (needs a firmware-masked MT7601U VID/PID or damaged descriptors) at attach time. Hardware-gated in-kernel; not exercised on the guest.",
  "exploit_chain": "plug malformed/faulty USB device with MT7601U VID:PID -> usbd_transfer_setup fails -> MTW_UNLOCK of unheld lockmgr -> assertion failure/panic at attach",
  "evidence": "Code-cited: 541 goto detach with the only MTW_LOCK at 550; detach label at 692-693. VERDICT.md. untested (no USB device model in guest)",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_mtw.c:541",
    "sys/bus/u4b/wlan/if_mtw.c:550",
    "sys/bus/u4b/wlan/if_mtw.c:692",
    "sys/bus/u4b/wlan/if_mtw.c:749"
  ],
  "poc_changes": "",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "All mtw(4) paths are hardware-gated on the QEMU guest (no USB controller is passed through and no MT7601U device model exists); evidence is in-kernel structural (DF-5258: kld probe against the real if_mtwvar.h) or userland interleaving simulation mirroring the exact code regions/lock domains, per the wlan-trio pass-2 methodology (cf. DF-5246..DF-5257).",
  "recommended_fix": "Separate detach_nolock label for the pre-lock failure path",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}