run_key_set defers a raw ieee80211_key pointer that can be node-embedded (pairwise) and freed before run_key_set_cb executes - UAF read/write including k->wk_pad write

Summary

sc->cmdq[i].k = k (raw, pairwise k = &ni->ni_ucastkey); nodes freed on deauth without draining cmdq_task and the driver never installs iv_key_update_begin/end (null_key_update) - run_key_set_cb derefs freed node memory: reads wk_cipher/wk_key (32B) into register writes + writes k->wk_pad=wcid (8-byte UAF write). Narrow taskqueue-latency window, privileged key install to arm. Copy-key-material-into-slot fix (run_key_delete already does).