wireshark pcap file is on its way.
This always happens post login so it's not quite a DOS attack.
Looks like this is not specific to the API.
It also happens if I send the equivalent command set in a script file to the ftp server and name the file *.auto.rsc
It seems as if both the API and the ftp server are feeding a process which is parsing and executing routeros commands. For some reason this process is intermittently blowing up. If you observe the blowup the first time (evidenced by the appearance of autosupout.rif) and reboot you will be ok. But if you do not pay attention and it happens again without a reboot the CPU gets pegged at 100%.
I was able to narrow the script down to the following two commands
/interface wireless set *4 country="us 5.8 direct" adaptive-noise-immunity="none" mode="station-wds" band="5ghz-5mhz" frequency="5745" supported-rates-a/g="6Mbps" basic-rates-a/g="6Mbps" ssid="changeme2" frequency-mode="manual-txpower" antenna-gain="23" tx-power="28" burst-time="disabled" dfs-mode="radar-detect" wmm-support="disabled" hide-ssid="yes"
/interface wireless security-profiles set *1 mode="dynamic-keys" authentication-types="wpa2-psk" group-ciphers="tkip,aes-ccm" unicast-ciphers="tkip,aes-ccm" eap-methods="passthrough" wpa2-pre-shared-key="changeme" radius-mac-authentication="no" group-key-update="00:05:00"
The first command is 352 bytes/characters long and the second command is 272 bytes/characters long
I made a script putting the above two commands in a script in a for loop of 100 iterations and ran the script in the winbox terminal window via 'import myscript.rsc'. This executed without trouble.
I'd bet a nickel that this has something to do with the length of the above commands and the process getting fed by the API and ftp server.
BTW, I understand that when you ftp upload a script named *.auto.rsc that routeros is supposed to execute it on the spot but I've been observing that it does not get executed the first time I upload it after a reboot. Every time after that, routeros attempts to execute it as advertised.
I bet other folks can verify this if they exercise things enough. I have observed the crash in as little as one try and sometimes it takes more than ten and once in a blue moon more than 20.