DF-3365 — sta_entry has no reference count: three more unlocked-use windows beyond DF-0395/0396

File: sys/netproto/802_11/wlan/ieee80211_scan_sta.c (pass 2)

What

struct sta_entry objects are protected only by the scan table lock. Besides the known DF-0395 (sta_lookup callers) and DF-0396 (sta_iterate callback), pass 2 found three additional sites that use an entry after dropping the table lock:

1. sta_add() PICK1ST tail — the lock is released at ieee80211_scan_sta.c:397 and match_bss(vap, ss, se, ...) at :403 then reads se->se_chan, se_capinfo, se_ssid, se_ies.*, se_rates unlocked. Runs on every beacon while a IEEE80211_SCAN_PICK1ST scan is active and the entry keeps failing match (GOTPICK never sets).
2. select_bss() return value — released at :1210; sta_pick_bss (:1269-1272), adhoc_pick_bss (:1658-1669), mesh_pick_bss (:1920-1923) and sta_roam_check (:1353-1366) then dereference selbs->base.se_chan/se_flags and hand &selbs->base to ieee80211_sta_join(), which copies ~the whole entry including se_ies.data/se_ies.len into a fresh node blob (ieee80211_node.c:832) — a freed blob would be read wholesale.
3. sta_roam_check / sta_assoc_fail / sta_assoc_success use sta_lookup() results unlocked (the DF-0395 family, listed for completeness).

These are genuine cross-thread windows on DragonFly, not paper locks: the beacon rx path runs under wlan_global_serializer (ieee80211.c:720: ether_ifattach(ifp, mac, &wlan_global_serializer)), while the freeing contexts do not — ieee80211_node_timeout is a raw callout (ieee80211_node.c:2239-2264) that calls ieee80211_scan_timeout -> scan_age -> adhoc_age frees under the table lock only, and the sw-scan state machine runs on ic->ic_tq taskqueue threads under ic_comlock (ieee80211_scan_sw.c:624-699). Nothing serializes rx vs purge/join.

Verification attempt (not reproduced at runtime)

fwscan.ko raced thread A (serializer-held beacon injection loop with PICK1ST armed, rssi=1 so match always fails and the :403 tail runs on every frame) against thread B (serializer-free scan_flush loop, the same table-lock-only discipline as node_timeout). 60s run: 150,000 injections; 120s run with debug.use_weird_array=1 (kfree junk-fill 0xdeadc0de): 21,800 injections. No panic, no observable corruption — the window is a few hundred ns inside a multi-µs path and even on a hit the reads land in mapped stale/junked slab memory.

Fix

fix.diff (validated with the DF-3363 kernel build) closes window (1) by keeping the table lock across the PICK1ST match_bss tail. The full remedy for (2) is entry reference counting (upstream-style se_refcnt); the pragmatic hardening in fix.diff documents this.