# DF-5293 — deferred rum_cmdq entry holds a raw vap pointer past rum_vap_delete()

## What
`rum_update_beacon()` queues a DEFERRED command carrying the RAW
`struct ieee80211vap *`:

```c
sys/bus/u4b/wlan/if_rum.c:2830
	rum_cmd_sleepable(sc, &vap, sizeof(vap), 0, rum_update_beacon_cb);
```

`rum_cmd_sleepable()` (:745-771) copies the pointer into `cmdq[]` and merely
`ieee80211_runtask()`s — asynchronous.  The taskqueue thread later runs
`rum_cmdq_cb` (:723-743) → `rum_update_beacon_cb` (:2784-2790) →
`rum_set_beacon(sc, data->vap)` (:2729), which dereferences
`rvp->bcn_mbuf` (:2733) and `vap->iv_txparms` (:2744) and streams
`mtod(m)/m_pkthdr.len` bytes to the device (:2754-2755).

`rum_vap_delete()` (:709-721) frees `rvp->bcn_mbuf` (:715) and
`kfree(rvp, M_80211_VAP)` (:720) — it drains `rvp->ratectl_task` (:717) but
**never drains `sc->cmdq_task` nor purges cmdq entries referencing the vap**.
A queued `rum_update_beacon_cb` therefore executes on freed memory: UAF read
of the `rum_vap` (M_80211_VAP, ~0x2c0 bytes) and wild `rum_write_multi`
read from the freed mbuf, sized by freed-heap garbage.

Twin of DF-5247 (if_run) / DF-5260 (if_mtw).  Note: unlike run/mtw's
DF-5249/5262 twins, rum's cmdq ring itself IS properly locked
(producers take RUM_CMDQ_LOCK at :753-766), and `rum_key_set/rum_key_delete`
copy the key BY VALUE (:3021/:3038) so the DF-5250/5263 raw-key UAF does not
apply — the vap pointer at :2830 is the one dangling reference.

## Hardware gating
rum(4) needs an RT2573 USB dongle; the QEMU guest has none.  Evidence is the
line-level lifetime trace plus a userland model of the queue/taskqueue/destroy
protocol (`rum_cmdq_uaf.c`), 3×10 s per mode on the guest.

## Build / Run / Expected
```
cc -O2 -pthread -Wall -o rum_cmdq_uaf rum_cmdq_uaf.c
./rum_cmdq_uaf 10 0    # shipped: no drain  -> POST-FREE rum_set_beacon > 0
./rum_cmdq_uaf 10 1    # fixed: draintask before kfree -> exactly 0
```
See `run.log`: shipped 11599/11849/12071 post-free executions of the cb;
fixed mode 0/0/0.

## Fix
`fix.diff` — `ieee80211_draintask(ic, &sc->cmdq_task)` in `rum_vap_delete`
before the vap memory is freed (what the sim's mode 1 models).
`git apply --check` clean.  Kernel fix validation hardware-gated
(`fix_status: not_testable`).