{
  "finding_id": "DF-5266",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "MTW_AID2WCID(aid) = 1 + (aid & 0x7) (if_mtwvar.h:37) maps all 64 possible AIDs (vap->iv_max_aid = MTW_WCID_MAX = 64, if_mtw.c:820) onto WCIDs 1..8 only, while the hardware key tables are indexed by WCID up to MTW_WCID_MAX=64 (MTW_PKEY(wcid), if_mtwreg.h:258). AIDs 9..64 collide with AIDs 1..8: mtw_key_set_cb() installs the pairwise key of the later station into the shared slot (base = MTW_PKEY(wcid), if_mtw.c:1999-2001), and mtw_tx() encrypts downlink frames with txwi->wcid = MTW_AID2WCID(ni->ni_associd) (3157-3160). From the 9th association on, frames addressed to station A are encrypted under whichever colliding stations key was installed last: on WPA2-Enterprise (per-statement keys) a malicious authenticated station that associates after the victim with a colliding AID receives the ability to decrypt the victims unicast downlink traffic (the hardware encrypts it with the attackers key). Deterministic mechanism, verified against the macro and call sites; in-kernel demonstration requires two RF peers and the dongle (hardware-gated).",
  "exploit_chain": "hostap + WPA2-Enterprise + >=9 stations -> attacker associates, AID collides with victims (guaranteed within 9) -> attackers pairwise key lands in victims WCID slot -> victims downlink frames encrypted with attackers key -> attacker decrypts victim traffic",
  "evidence": "Code-cited: AID2WCID macro, iv_max_aid=MTW_WCID_MAX, key install at MTW_PKEY(wcid), txwi->wcid selection. VERDICT.md collision table (aid 1 & 9 -> wcid 2, aid 2 & 10 -> wcid 3, ...)",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_mtwvar.h:37",
    "sys/bus/u4b/wlan/if_mtw.c:820",
    "sys/bus/u4b/wlan/if_mtw.c:1999",
    "sys/bus/u4b/wlan/if_mtw.c:3157",
    "sys/bus/u4b/wlan/if_mtwreg.h:258"
  ],
  "poc_changes": "",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "All mtw(4) paths are hardware-gated on the QEMU guest (no USB controller is passed through and no MT7601U device model exists); evidence is in-kernel structural (DF-5258: kld probe against the real if_mtwvar.h) or userland interleaving simulation mirroring the exact code regions/lock domains, per the wlan-trio pass-2 methodology (cf. DF-5246..DF-5257).",
  "recommended_fix": "Use the AID directly (WCID table supports 64) and cap iv_max_aid at MTW_WCID_MAX-1",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified with git apply --check against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}