diff --git a/sys/netbt/l2cap_signal.c b/sys/netbt/l2cap_signal.c
--- a/sys/netbt/l2cap_signal.c
+++ b/sys/netbt/l2cap_signal.c
@@ -67,7 +67,15 @@
 void
 l2cap_recv_signal(struct mbuf *m, struct hci_link *link)
 {
-	l2cap_cmd_hdr_t cmd;
+	/*
+	 * Zero-initialise cmd: if the first mbuf is shorter than a command
+	 * header (m->m_pkthdr.len < sizeof(cmd)) we `goto reject` BEFORE
+	 * m_copydata() populates it, and l2cap_send_command_rej() below would
+	 * otherwise embed the uninitialized cmd.ident into the outgoing
+	 * L2CAP_COMMAND_REJ packet, leaking one byte of kernel stack per
+	 * short packet.  (DF-0540)
+	 */
+	l2cap_cmd_hdr_t cmd = { 0 };
 
 	for(;;) {
 		if (m->m_pkthdr.len == 0)