# DF-0325 PoC — Bluetooth L2CAP callout deadlock

## Status: REAL (source-trace confirmed), not testable on this guest

The deadlock is confirmed by tracing:
- `ng_btsocket_l2cap_untimeout()` holds `pcb_lock` then calls
  `callout_stop()` (sync=1) which blocks until the callback finishes
- The callback `ng_btsocket_l2cap_process_timeout()` needs `pcb_lock`
  as its first action
- Classic AB-BA deadlock

**Not testable** because:
- `ng_btsocket_l2cap` module is not loaded by default
- Not compiled into GENERIC kernel
- Requires Bluetooth hardware (none on guest)
- Loading requires `kldload` (root-only, invalidates unpriv chain)

## Fix

See `fix.diff` — replaces `callout_stop()` with
`callout_stop_async()` to avoid the synchronous wait.