=== Guest environment (DF-0542 / DF-0543 verification) ===
uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
kernel config: X86_64_GENERIC (options INVARIANTS ON by default)
cc: cc 8.3 [DragonFly] Release/2019-02-22
snapshot: with-src (#0 unpatched baseline, full /usr/src tree + warm obj)

=== Module availability (netgraph7 bluetooth) ===
- sys/conf/files gates ng_hci_evnt.c on:  optional netgraph7_bluetooth
- X86_64_GENERIC contains NO "netgraph7" option -> NOT compiled into kernel.
- NO bluetooth/netgraph7 .ko shipped in /boot/kernel/.
  (the 8 /boot/kernel hits for "hci" are ahci/ehci/ohci/sdhci/uhci/xhci --
   USB/SATA host controllers, not Bluetooth HCI.)
- Standalone KLD module build DOES work:
    cd /usr/src/sys/netgraph7/bluetooth/hci && make   -> ng_hci.ko (objdir)
- But the built module does NOT load on the default guest:
    kldload ng_hci.ko -> "KLD ng_hci.ko depends on ng_bluetooth - not available"
  (the whole netgraph7 bluetooth framework ng_bluetooth.ko is absent).

=== Old netgraph bluetooth? ===
sys/netgraph/bluetooth/ does NOT exist in this tree -> there is no
"old netgraph BT" copy of ng_hci_evnt.c that could carry the same bug.
The vulnerable code exists ONLY in netgraph7.

=== Reachability conclusion ===
DF-0542 / DF-0543 are DEAD CODE on the default guest: not in GENERIC, not
shipped, not loadable without building+loading the entire netgraph7 bluetooth
stack (root) AND attaching real Bluetooth hardware (ng_ubt/ng_h4 driver) to
inject HCI events. Source-confirmed real; runtime-unreachable here.