{
  "finding_id": "DF-5295",
  "status": "inconclusive",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Deterministic driver-logic defect, provable from source without hardware. rum_tx_mgt() pops the tx_free head and decrements tx_nfree (if_rum.c:1478-1480) BEFORE validating the frame; the ENOENT (:1490, Protected mgmt frame with no tx key) and ENOBUFS (:1494, SWCRYPT ic_encap failure) returns orphan the popped entry permanently - it is on no list, holds no mbuf, and tx_nfree is never restored. RUM_TX_LIST_COUNT=8 / RUM_TX_MINFREE=2 (if_rumvar.h:29-30): seven such errors wedge the TX path (rum_start gate :1734 and rum_raw_xmit gate :3055 both fail), recoverable only via rum_init->rum_setup_tx_list (:2577), i.e. ifconfig down/up. Sibling rum_tx_data() performs the same key checks BEFORE its pop (:1631-1645 vs pop at :1670) and frees the mbuf on error - the pop-before-validate ordering is unique to rum_tx_mgt. Trigger is privileged (raw 802.11 injection via bpf on the wlan interface; /dev/bpf is root-only), the caller ieee80211_raw_output (ieee80211_output.c:631-639) correctly frees mbuf+node on error, so impact is a local, privileged, recoverable TX-path DoS => Low severity. Hardware-gated in-kernel (no RT2573 on the guest); the exact state machine was modeled and run on the guest: wedge after exactly 7 injections, down/up restores tx_nfree=8.",
  "exploit_chain": "root: 7x bpf-injected Protected-flag mgmt frames with no key -> tx_nfree 8->1 -> rum_start/rum_raw_xmit gates fail -> interface TX wedged until admin down/up (availability only, no memory-safety impact)",
  "evidence": "run.log: injected 16 ... orphaned slots=16; tx_nfree=1 / TX path wedged after 7 injections / after ifconfig down/up: tx_nfree=8; rum_txslot_leak.c models :1478-1480, :1490, :1734 and the :2577 recovery exactly",
  "kernel_refs": [
    "sys/bus/u4b/wlan/if_rum.c:1478",
    "sys/bus/u4b/wlan/if_rum.c:1490",
    "sys/bus/u4b/wlan/if_rum.c:1494",
    "sys/bus/u4b/wlan/if_rum.c:1631",
    "sys/bus/u4b/wlan/if_rum.c:1670",
    "sys/bus/u4b/wlan/if_rum.c:1734",
    "sys/bus/u4b/wlan/if_rum.c:3055",
    "sys/bus/u4b/wlan/if_rum.c:2577",
    "sys/bus/u4b/wlan/if_rumvar.h:29",
    "sys/netproto/802_11/wlan/ieee80211_output.c:631"
  ],
  "poc_changes": "No seed; exact state-machine model of the pop/error/gate/recovery logic",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o rum_txslot_leak rum_txslot_leak.c",
  "run_cmd": "./rum_txslot_leak",
  "code_hash": "e9a99b4d830fb6d9ade9f059e8a435bfbe25d334ed86b67d41e4c79b4f45e7c5",
  "notes": "Deterministic; confidence certain in the code defect, inconclusive only because in-kernel execution is hardware-gated. Low severity: privileged trigger, recoverable wedge, no memory corruption.",
  "recommended_fix": "In rum_tx_mgt(), take the tx_free slot only after the PROTECTED/key validation block (mirror rum_tx_datas ordering)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (move the pop after validation) verified with git apply --check against the pristine sys/ tree; kernel behavior not exercisable without RT2573 hardware. Hardware-gated: not_testable.",
  "fix_evidence": "fix.diff (git-apply clean); VERDICT.md"
}