=== DF-0540 reachability probe on guest (netbt not compiled; no BT HW) ===
netbt compiled in kernel?  nm /boot/kernel/kernel | grep -c l2cap_recv_signal  -> 0
options bluetooth in GENERIC?  grep -ci bluetooth /usr/src/sys/config/X86_64_GENERIC -> 0
l2cap_signal.c build rule:   sys/conf/files:1615  netbt/l2cap_signal.c  optional bluetooth
Bluetooth HCI unit present?  devinfo | grep -iE "hci|netbt|bluetooth"  -> (empty)

=> The vulnerable function l2cap_recv_signal is dead code on this guest (netbt
   is `optional bluetooth`, not enabled), and there is no Bluetooth hardware to
   inject a short L2CAP packet. Source-level defect confirmed by trace; not
   runtime-exercisable here.