# DF-0453 VERDICT

## Verdict: REPRODUCED (source+harness, no Bluetooth hardware)

## Mechanism
`rfcomm_session_newconn` at `sys/netbt/rfcomm_session.c:423-428` creates a new
RFCOMM session (`new` at line 416) and intends to arm an expiry timer on it
(comment at 423-426: "schedule an expiry so that if nothing comes of it we can
punt"). But `callout_reset` at line 427-428 uses `&rs->rs_timeout` and passes
`rs` (the LISTENER session, the function's `arg` parameter) instead of
`&new->rs_timeout` and `new`.

**Consequence 1**: The new session has NO expiry timer. If a remote BT peer opens
L2CAP but never sends SABM(0), the session and its L2CAP state leak indefinitely.
Repeated connections → memory exhaustion DoS.

**Consequence 2**: The listener gets a spurious `mcc_timeout` → fires
`rfcomm_session_timeout` on the listener → may free/close the listener permanently,
disabling RFCOMM service.

## Why not live-tested
Bluetooth hardware is unavailable on the QEMU guest. The bug is a pure logic
error (wrong variable used) confirmed by source inspection and harness.

## PoC changes
- `harness.c`: replicates `rfcomm_session_newconn` logic showing timer armed on
  listener instead of new session.
- `fix.diff`: changes `&rs->rs_timeout` → `&new->rs_timeout`, `rs` → `new`.

## Fix validation
Fix.diff applied to patched kernel (build rc=0, boots as #1). The netbt.ko
module with the fix compiles. Live trigger requires Bluetooth hardware
(not_testable on this guest).