=== DF-0688 fix-validation: PATCHED netbt.ko ===
=== patched module: /boot/kernel/netbt.ko sha256=0f2c251b... ===
=== baseline (with-src #0) kernel; only netbt.ko replaced ===
=== run 3x as maxx (unprivileged) after kldload netbt.ko ===

$ id
uid=1001(maxx) ...

$ kldstat | grep netbt
 4    1 0xffffffff82600000     e000 netbt.ko   (patched, smaller — no inline panic path)

$ ./sco_setsockopt_panic
[*] got SCO socket fd=3; firing setsockopt (any name, any val)
[!] setsockopt returned (this should NOT happen if bug present): Input/output error
[+] reached end of main without panic -> bug NOT reproduced on this kernel
RUN_EXIT=0

(repeated 3x — identical, deterministic, no panic)

Status: up (kernel unaffected)

=== before/after contrast ===
BEFORE (with-src #0 + unpatched netbt.ko):
    Fatal trap 12: page fault while in kernel mode
    fault virtual address    = 0x10
    Stopped at      sco_ctloutput.cold.2+0x19:      movq    0x10,%rax
AFTER  (with-src #0 + PATCHED netbt.ko):
    setsockopt returns EIO ("Input/output error"); guest stays up.

=> Fix VALIDATED. The added `break` at sco_socket.c:131 short-circuits the
   m_len==0 path so line 133 (mtod(NULL,...)) is no longer reached.