/tmp/args_overflow.c:57:32: warning: "/*" within comment [-Wcomment]
  * The headers above (netgraph7/*, bluetooth/*) live inside the kernel tree
                                 
/tmp/args_overflow.c:57:45: warning: "/*" within comment [-Wcomment]
DF-0625: ng_l2cap L2CA_Ping missing arglen check

This PoC would, on a kernel with working ng_l2cap + an HCI
lower layer connected:
  1. open a netgraph control socket
  2. create + connect an l2cap node
  3. send NGM_L2CAP_L2CA_PING with arglen=8, echo_size=200
  4. trigger _ng_l2cap_echo_req's m_copyback to read ~192 bytes
     past the ng_mesg allocation into adjacent kernel heap
  5. capture the resulting L2CAP Echo Request at the attacker's
     Bluetooth peer to recover kernel heap contents

On THIS audit guest: no Bluetooth hardware and no ng_hci lower
layer, so ng_l2cap_lp_con_req returns ENOTCONN and the bug path
is unreachable. The bug is confirmed in source (see VERDICT.md)
and the fix is in fix.diff.