CVE-2026-74554 in the ath12k driver exposes a design failure where peer ID representation conflates an index with a validity flag in a single field. The driver stores ATH12K_PEER_ML_ID_VALID (BIT(13)) directly in dp_peer->peer_id, meaning every MLO peer carries a value >= 0x2000. Yet bitmap operations expect a raw index — this forces every developer touching peer cleanup to manually strip the flag before use. One developer forgot. That's not a moral failure; it's predictable friction in an API that violated the principle of representation separation.
The resource exhaustion consequence is the more dangerous component. Because the VALID bit was never cleared, ath12k_peer_ml_alloc() eventually starves. You don't need to trigger the out-of-bounds write repeatedly — a single missed clear leaves a time bomb that degrades device availability progressively. The OOB clear_bit corrupts memory adjacent to the bitmap, not the bitmap itself, which means the corruption may go undetected in testing while the allocation starvation compounds with each MLO peer disassociation.
The fix reasserts ahsta->ml_peer_id as the canonical source — and notably, that correct ID was already being maintained redundantly. Two sources of truth for the same concept is a design smell that invites desynchronization. A type-safe accessor pattern would have forced correct usage; absent that, the driver relies on tribal knowledge.
This pattern isn't isolated. CVE-2019-3906 (InfiniBand drivers), CVE-2021-43294 (amdgpu), and CVE-2022-20422 (staging) all exhibit the same structural conflation: a field encoding presence AND value, with downstream consumers forgetting to decode before bitmap/array indexing. The genealogical record suggests this correlates with MLO/Multi-Link support across vendors — new protocol complexity creates ID spaces developers handle inconsistently.
The CVSS 8.8 weights the transient memory corruption, but the time bomb is more reliably exploitable. Memory corruption is stochastic, depending on allocator state and adjacent object lifetimes. Resource exhaustion is deterministic: every missed clear_bit permanently removes a slot from the 256-peer bitmap. An attacker understanding this needs one trigger to set up progressive degradation. The chronic exhaustion component is systematically underweighted by CVSS, which treats vulnerabilities as acute events rather than self-compounding debt.