# DF-0454 — rfcomm_session_recv_mcc_rpn uninitialized stack info leak

## Verdict
**REPRODUCED (source-confirmed)** — the bug is real but not live-triggerable on this guest (no Bluetooth hardware / BT peer).

## Mechanism
`rfcomm_session_recv_mcc_rpn` (`sys/netbt/rfcomm_session.c:1212-1270`) processes an RFCOMM Remote Port Negotiation command. When `m->m_pkthdr.len == 1` (line 1230), only **1 byte** is copied via `m_copydata(m, 0, 1, &rpn)` into the 8-byte `struct rfcomm_mcc_rpn` (line 1231). That single byte fills `rpn.dlci` (offset 0); `bit_rate`/`line_settings`/`flow_control`/`xon_char`/`xoff_char` (offsets 1-5) are pre-initialized by the defaults at lines 1221-1225. But `rpn.param_mask` (offsets 6-7, a `uint16_t`) is **NEVER written** in this branch.

Line 1232 then reads `rpn.param_mask = letoh16(rpn.param_mask)` — **2 uninitialized stack bytes**. Lines 1240-1265 compute `mask` from the uninitialized `param_mask` bits (the value checks always pass because the other fields are RFCOMM defaults). Line 1269 sends the full 8-byte `rpn` struct to the remote peer via `rfcomm_session_send_mcc`. The attacker recovers up to ~7 bits of kernel stack per request from the response `param_mask`.

## Threat model
Unauthenticated remote Bluetooth peer sends a 1-byte RPN MCC request and observes the `param_mask` bits in the response. Requires an active BT HCI transport attached to the netbt stack.

## Why not live-triggered on this guest
The QEMU/KVM audit guest has **no Bluetooth hardware** and no virtual BT HCI. Loading `netbt.ko` creates the `net.bluetooth.*` sysctl tree and the BT socket domain, but cannot receive RFCOMM frames without a lower-layer HCI driver. The bug is confirmed by source inspection of `rfcomm_session.c:1227-1232` and the struct layout in `rfcomm.h:179-188` (8-byte `__packed__` struct; `param_mask` at bytes 6-7).

## PoC
`df0454_model.c` — a userspace model that replicates the exact struct layout and code path, demonstrating that `param_mask` is never written in the `len==1` branch.

## Fix
`fix.diff` — add `memset(&rpn, 0, sizeof(rpn))` before the defaults so `param_mask` is zeroed. Validated by building the fixed `netbt.ko` (compiles cleanly; runtime not testable without BT HW).

## Build / Run
```
cc -o df0454_model df0454_model.c
./df0454_model
```