=== DF-0683 live-trigger check (6.5-DEVELOPMENT #0) ===
$ ifconfig | grep -i bt      # (empty)
$ ls /dev/bt* /dev/bluetooth*
ls: No such file or directory
$ sysctl net.bluetooth.hci   # (no hci_unit registered)

=== Conclusion ===
No Bluetooth hardware in the VM -> no hci_unit -> hci_disable is never called.
Race cannot be exercised here. Source-level analysis (see VERDICT.md) shows
the race is real: hci_disable tears down hci_links / rx queues / eventqlen
WITHOUT hci_devlock, while hci_intr (netisr-driven) holds hci_devlock around
its concurrent reads of the same fields.