# DF-0508 VERDICT

## Verdict: REPRODUCED (dead code)

## Mechanism
Source: `sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c:599-600,1317-1322`

L2CAP ConfigReq pkthdr.len inflation.

netgraph7 is NOT compiled on DragonFlyBSD master. Source trace confirms the bug at lines 599-600 (m_pkthdr.len overwritten with attacker-controlled hdr.length) and 1317-1322 (get_next_l2cap_opt default case returns -3 without validating hdr.length). Harness demonstrates the inflation logic.

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.