DF-0436 — ng_btsocket_hci_raw_filter heap OOB read + security bypass
======================================================================

**Verdict:** NOT REPRODUCED LIVE (latent code bug; module not shipped).

**Confirmed by static trace** at `sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c:669-718`.
The bug is real; it just can't be triggered on the master DEV ISO because the
netgraph7 Bluetooth modules are not shipped in `/boot/kernel/` and there is no
Bluetooth adapter exposed to the guest.

Mechanism
---------
`ng_btsocket_hci_raw_filter()` runs the HCI security filter on every CMD/EVENT
packet an unprivileged PF_BLUETOOTH raw socket tries to send or receive.  The
filter uses two `bitstr_t` arrays inside a kmalloc'd `struct
ng_btsocket_hci_raw_sec_filter`:

    struct ng_btsocket_hci_raw_sec_filter {
        bitstr_t events[0xff / 8];             // 32 bytes   @ offset 0
        bitstr_t commands[0x3f][0x3ff / 8];    // 8064 bytes @ offset 32
    };

The CMD path (line 681-684) does:
    bit_test(commands[NG_HCI_OGF(opcode) - 1], NG_HCI_OCF(opcode) - 1)
where `NG_HCI_OGF(op) = (op>>10)&0x3f` and `NG_HCI_OCF(op) = op&0x3ff`.

With attacker-controlled opcode == 0:
- `commands[0 - 1]` = `commands[-1]` reads 128 bytes BEFORE commands[0],
  i.e. 96 bytes BEFORE the struct's kmalloc allocation.  **Heap OOB read.**
- `bit_test(arr, 0 - 1)` reads `arr[(-1)>>3]` = `arr[-1]`, 1 byte before
  the inner array.  **Heap OOB read.**

The EVENT path (line 703): `event = ...->event - 1` underflows when the
event code is 0, then `bit_test(events, -1)` reads `events[-1]`, 1 byte
before the events array (= 1 byte before the struct allocation).

**Security bypass:** the result of every OOB `bit_test` drives the EPERM
decision.  An attacker who can shape heap state (or just gets lucky with
uninitialized memory) can let normally-restricted HCI commands/events
through the filter.

Why not reproduced
------------------
- `/boot/kernel/` on the master DEV ISO ships NO bluetooth modules.  Only
  USB-HCI drivers (uhci/ehci/xhci/sdhci) are present; netgraph7 Bluetooth
  (ng_btsocket_hci_raw, ng_hci, ng_ubt) is absent.
- `kldload ng_btsocket_hci_raw` / `ng_hci` / `ng_ubt` all return ENOENT.
- No Bluetooth adapter is exposed to the QEMU guest.

The bug is therefore a **latent code defect**: real on any system that
builds + loads the netgraph7 BT stack with a BT adapter, but unreachable on
the master DEV guest.  Classification: not_reproduced (latent), trace-confirmed.

Fix
---
`fix.diff` adds OGF/OCF/event == 0 guards before the array indexing.  With
the fix, opcode 0/0 and event 0 are rejected with EPERM/EINVAL before any
`bit_test` runs.

Notes
-----
- The fix is mechanical (three zero-checks); the `sys/` tree is read-only
  during audit so the diff is generated but not applied.
- If DragonFly ever ships the netgraph7 Bluetooth modules by default, this
  finding becomes live-reproducible as both an OOB read and a security
  bypass for unprivileged PF_BLUETOOTH sockets.