=== DF-0688 panic signature (excerpt from dfbsd-qemu/boot.log) ===

Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x10
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff8260d00d
stack pointer	        = 0x10:0xfffff8008d1f8a60
frame pointer	        = 0x10:0xfffff8008d1f8a80
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      sco_ctloutput.cold.2+0x19:      movq    0x10,%rax
db>

=== Interpretation ===

fault virtual address 0x10  == offsetof(struct mbuf, m_data)
(sco_socket.c:133) err = sco_setopt(pcb, sopt->sopt_name, mtod(m, uint8_t *));
       mtod(NULL, uint8_t*) expands to ((uint8_t*)((NULL)->m_data))
       -> read at address 0x10 -> page not present -> fatal trap 12

The .cold.2 symbol is the cold path off sco_ctloutput that GCC outlined for the
"m->m_len == 0" branch (m_freem(m); m=NULL; err=EIO).  Because line 132 lacks
a `break`/`return`, control falls through to line 133 where mtod(NULL,...)
traps.

This is the unconditional panic the finding describes — fired by an
unprivileged user (uid 1001) via a single setsockopt() after the admin
loaded netbt.ko for Bluetooth support.