$ cc -O -o bt2430 bt2430.c && ./bt2430
loop exited with i=5 (model[] has 5 bytes)
canary bytes after softc: 00 42 42 42 42 42 42 42
verdict: OOB NUL WRITE at bt->model[5], one byte past the softc (canary 0x42 overwritten with 0x00)
rc=0

Source-level harness of the exact bt.c:420-425 loop semantics (5-byte
reply, no 0x20, fifth byte 0x00 per btreg.h:418 comment).  char
model[5] is the LAST field of struct bt_softc (btreg.h:638);
sizeof(struct bt_softc) = 344 on this build, so the terminator lands
at softc+344.