===== BUGGY transcription (l2cap_rtx as in sys/netbt/l2cap_misc.c) =====
DF-0746 harness: UAF read of req->lr_id in l2cap_rtx after zfree
transcribed from sys/netbt/l2cap_misc.c:163-197
vm_zone model from sys/vm/vm_zone.c:87-244

== Test 1: stale read of req->lr_id immediately after zfree ==
l2cap_rtx: cid 0, ident 66
  g_uaf_read_observed = 1
  g_uaf_read_value    = 0x42 (original was 0x42)
UAF READ CONFIRMED: req->lr_id dereferenced after zfree
  stale value at offset 17 == original id (no slab reuse yet)

== Test 2: read after same-CPU slab reuse (latent risk) ==
  read of freed req->lr_id returned 0xdd (reused slot wrote 0xDD)
UAF READ CONFIRMED: freed req->lr_id returns attacker-shaped byte

== Summary ==
BUG: l2cap_rtx reads req->lr_id AFTER zfree(l2cap_req_pool, req)
     at sys/netbt/l2cap_misc.c:192 (free at :173 via :190).
RUNTIME IMPACT on default X86_64_GENERIC kernel: NONE —
     netbt is `optional bluetooth` (not in GENERIC), and even in
     the netbt.ko module DPRINTF is ((void)0) without -DBLUETOOTH_DEBUG,
     so the deref is never emitted in production. Latent hardening
     bug for BLUETOOTH_DEBUG builds.
HARNESS_RC=0

===== FIXED transcription (lr_id captured before free) =====
DF-0746 FIXED harness: lr_id saved before free

l2cap_rtx: cid 0, ident 66

g_post_free_read = 0 (must be 0: no byte of *req read after free)
FIXED: no read of *req after zfree; DPRINTF used the saved local
HARNESS_FIXED_RC=0