The CVSS 5.3 rating for this buffer pool exhaustion flaw fundamentally misrepresents the actual risk. The scoring anchors on 'high complexity on-demand exploitation' via deauthentication attacks, but this framing ignores that the pool will exhaust through normal operation alone — making every deployed device a time bomb regardless of adversarial intent.
The vulnerability lies in the Wi-Fi Host Driver (WHD) error path: when whd_network_send_ethernet_data() fails to transmit and doesn't consume the buffer, the caller must release it, but the error path leaks the buffer instead. The pool holds 20 buffers. Any transient TX failure — from RF interference, roaming events, or upper-layer stack bugs — permanently consumes one buffer. Over the device's operational lifetime, ordinary network churn will drain the pool just as certainly as a targeted attack, merely on a longer timescale.
The compounding factor the CVSS cannot weight: the same pool serves both TX and RX paths. A leak in the TX error path cascades into killing the receive path entirely, destroying all WHD-driven Wi-Fi operation. This shifts the failure mode categorically from 'degraded operation' to 'total loss.'
Detection: Monitor for TX packet drops and Wi-Fi interface flaps. Once the pool depletes, recovery requires physical or console-level intervention — not a service restart. This recovery burden is a severity multiplier that CVSS structurally cannot capture.
The semaphore duplication fixed in the same commit signals a driver lacking systematic error-path review. Treat this as diagnostic: other silent correctness issues likely remain.
Priority action: Identify all deployed devices using this Infineon/Broadcom-derived WHD stack. Treat any device with observable TX failures or Wi-Fi instability as already in the depletion cascade. The window between vulnerability disclosure and fielded patch for embedded components may be measured in years — the pool doesn't wait.