Summary

usbpf_xfertap at usb_pf.c:362 reads bus->ifp and at :488 dereferences bus->ifp->if_bpf with NO lock held (DONE tap path: USB_BUS_UNLOCK at usb_transfer.c:2393-2394 before tap call at :2434). usbpf_clone_destroy at usb_pf.c:191-194 does ubus->ifp=NULL; bpfdetach; if_detach; if_free WITHOUT acquiring USB_BUS_LOCK. Window between read (:362) and deref (:488) spans kmalloc+full header fill+usbd_copy_out = large deterministic window. Concurrent ifconfig usbusN destroy during active USB isochronous transfers frees ifnet mid-tap -> UAF. Root-only trigger (ifconfig create/destroy requires root; bus->ifp NULL until root creates interface). Controller hot-unplug NOT a trigger: usbpf_detach runs after usb_proc_free drains callbacks. SUBMIT tap less exposed (runs under bus lock at usb_transfer.c:2625) but clone_destroy still doesnt take bus lock. Fix: hold USB_BUS_LOCK across entire usbpf_xfertap critical section, and acquire same lock in clone_destroy around clearing ubus->ifp; OR move DONE tap invocation before USB_BUS_UNLOCK at usb_transfer.c:2393.