# DF-5295 — rum_tx_mgt() permanently orphans a tx_data slot on its
# early-error paths (TX path exhaustion)

## What
```c
sys/bus/u4b/wlan/if_rum.c:1478-1494
	data = STAILQ_FIRST(&sc->tx_free);
	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
	sc->tx_nfree--;                     <-- slot popped FIRST

	wh = mtod(m0, struct ieee80211_frame *);
	...
	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
		k = ieee80211_crypto_get_txkey(ni, m0);
		if (k == NULL)
			return (ENOENT);    <-- slot orphaned forever
		if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) &&
		    !k->wk_cipher->ic_encap(k, m0))
			return (ENOBUFS);   <-- slot orphaned forever
```
The entry is off `tx_free`, never goes to `tx_q`, holds no mbuf; nothing
ever increments `tx_nfree` for it again.  `RUM_TX_LIST_COUNT` is 8 and
`RUM_TX_MINFREE` is 2 (if_rumvar.h:29-30), so:

- `rum_start()` (:1734) gates on `tx_nfree >= RUM_TX_MINFREE` — after 7
  orphaned slots the interface stops dequeuing frames entirely;
- `rum_raw_xmit()` (:3055) gates the raw path the same way;
- only `rum_init()` → `rum_setup_tx_list()` (:2577/:787-804) restores the
  list, i.e. recovery needs `ifconfig down/up`.

Sibling comparison: `rum_tx_data()` performs the same key checks at
:1631-1645 BEFORE its pop (:1670) and `m_freem()`s on error — the
pop-before-validate ordering is unique to `rum_tx_mgt`.

Trigger: raw 802.11 management frame with the Protected flag set and no
matching key (or a failing SWCRYPT encap) through the legacy
`rum_raw_xmit()` path (params == NULL, :3060-3065) — i.e. bpf raw injection
on the wlan interface (privileged: /dev/bpf is root-only).  The caller
(`ieee80211_raw_output`, ieee80211_output.c:631-639) frees the mbuf and the
node on error — only the slot leaks.

## Hardware gating
Deterministic driver-logic bug; rum(4) needs absent RT2573 hardware.
`rum_txslot_leak.c` is an exact state-machine model of the pop/error/gate
logic.  Guest output (`run.log`): wedge after exactly 7 injections; only
down/up resets.

## Build / Run / Expected
```
cc -O2 -Wall -o rum_txslot_leak rum_txslot_leak.c && ./rum_txslot_leak
```
Expected: `TX path wedged after 7 injections ...; after ifconfig down/up:
tx_nfree=8`.

## Fix
`fix.diff` — move the pop after the validation block (mirror of
`rum_tx_data`).  `git apply --check` clean.  Kernel fix validation
hardware-gated (`fix_status: not_testable`).