# DF-0659 — `ng_l2cap_discon_untimeout` stale flag → panic via `con_ref/con_unref`

## Bug
`sys/netgraph7/bluetooth/l2cap/ng_l2cap_misc.c:223-238` —
`ng_l2cap_discon_untimeout()` returns `ETIMEDOUT` (when `ng_uncallout`
returns 0, meaning the callout already fired) **without clearing** the
`NG_L2CAP_CON_AUTO_DISCON_TIMO` flag. The caller `ng_l2cap_con_ref`
ignores the return value; the flag stays set; the subsequent
`con_unref → ng_l2cap_discon_timeout()` panics at line 204 (KASSERT
`!(flags & AUTO_DISCON_TIMO)`).

## Live trigger not possible on guest
The L2CAP code is `optional netgraph7_bluetooth_l2cap` — not built on
the default kernel or any loadable module. Verified:
```
$ ls /boot/kernel/ | grep -iE 'ng_l2cap|bluetooth|hci|ubt'
(empty)
```
Even when built, it needs Bluetooth HW + race timing on the auto-disconnect
timer (default 5 s) to fire the panic — neither available on the audit
guest. Verification is by source trace (see VERDICT.md).

## Reproduce (source-level)
Read `VERDICT.md` for the line-by-line mechanism trace from trigger to
panic, and `fix.diff` for the verified fix (clear the flag unconditionally
before checking `ng_uncallout`'s return value).

## Expected impact
Kernel panic = full system DoS for systems with built-in Bluetooth
L2CAP and an outgoing OPEN L2CAP connection to the attacker. Adjacent
network attacker (`AV:A`), high timing difficulty (`AC:H`). Not
unpriv→root.