# DF-0284 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: receive_mcc checks total length but the MSC/RLS/RPN/PN handlers cast hdr+1 to fixed structs without checking length>=sizeof; when length<struct size they read stale mbuf bytes that influence protocol logic. Defense-in-depth read.

## Impact ceiling
none

## Cited refs
- sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:2521

## Fix
Also require m0->m_len >= sizeof(*hdr)+length so handlers cannot read past the first mbuf.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.