diff --git a/sys/netbt/rfcomm_session.c b/sys/netbt/rfcomm_session.c
--- a/sys/netbt/rfcomm_session.c
+++ b/sys/netbt/rfcomm_session.c
@@ -1217,6 +1217,10 @@
 	if (cr == 0)	/* ignore ack */
 		return;
 
+	/* DF-0454: zero the struct so the len==1 path doesn't leak 2
+	 * uninitialized stack bytes via rpn.param_mask. */
+	memset(&rpn, 0, sizeof(rpn));
+
 	/* default values */
 	rpn.bit_rate = RFCOMM_RPN_BR_9600;
 	rpn.line_settings = RFCOMM_RPN_8_N_1;