DF-0558 / DF-0559 verification environment (DragonFlyBSD master DEV guest, QEMU/KVM)
================================================================================
uname -a:
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  x86_64
kern.version:
  DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
cc: cc 8.3 [DragonFly] Release/2019-02-22

Kernel config (sys/config/X86_64_GENERIC):
  options INVARIANTS          # ON (default GENERIC) -> KKASSERT traps are real
  device bt                   # enables 'bluetooth' (netbt) -> built as netbt.ko

Runtime reachability of the vulnerable code (sys/netbt/hci_event.c):
  - netbt is NOT compiled into /boot/kernel/kernel (nm shows no hci_event_*).
  - netbt.ko (2990744 B) is available as a loadable module but is NOT loaded
    by default; kldstat shows only ehci.ko + xhci.ko.
  - Even with netbt.ko loaded, the vulnerable handlers (hci_event_num_compl_pkts,
    hci_event_inquiry_result, hci_event_rssi_result) are only reached when a
    Bluetooth controller driver delivers an HCI event via hci_input().  The
    QEMU guest has NO Bluetooth controller hardware (no ubt/bt3c/bcsp driver
    attaches, no struct hci_unit is ever created).
  => The bug is therefore NOT runtime-triggerable on this guest (no controller
     => no hci_unit => hci_event() is never called).  Verified by source trace.

Hardening relevant to the KKASSERT/panic claim:
  INVARIANTS is ON in X86_64_GENERIC, so the per-iteration
  KKASSERT(m->m_pkthdr.len >= sizeof(ir/rr)) and the m_copydata NULL checks
  are compiled in: a malicious event with more claimed responses than actual
  records would panic on a real Bluetooth adapter (production default kernel).
  The fix replaces the unbounded loop / KKASSERT reliance with an explicit
  upfront bounds check + early return.