# DF-2538 — PoC verdict

**File:** `sys/netgraph7/bluetooth/hci/ng_hci_evnt.c`

**Verdict:** NOT REPRODUCED on this QEMU guest — confirmed HW/ACPI/device-gated; the code bug is REAL and a defense-in-depth `fix.diff` is attached.

## Mechanism (confirmed in source)

inquiry_result() loops ep->num_responses times (attacker-controlled u_int8_t from the HCI Inquiry Result event), reading 14 bytes per iteration via m_copydata/m_adj with no validation that the mbuf chain contains that much data. A malformed event whose num_responses exceeds the payload reads past the chain (KASSERT panic / NULL deref).

### Cited lines

- `sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:387-424`

## Why it does not reproduce on this guest

No Bluetooth controller (and netgraph7 bluetooth is not built into the running kernel: nm /boot/kernel/kernel inquiry_result=0). The bug needs a real or USB BT dongle emitting a malformed Inquiry Result event.

Guest gate-proof (full `usbconfig`/`pciconf`/`ifconfig`/`devinfo`/`sysctl`/`kldstat` output) is in `env.txt`.

## Defense-in-depth fix

Check event->m_len >= (sizeof(bdaddr)+3+CLASS_SIZE+sizeof(clock_offset)) each iteration and break if the remaining payload is too short.

The git-apply-able diff is in `fix.diff` (verified `git apply --check` clean).

## Classification

- `status`: not_reproduced
- `reproduced`: 0
- `impact`: none (not reachable on this guest; latent code bug confirmed in source)
- `confidence`: certain (code bug + gate both confirmed by direct source trace and guest enumeration)
- `fix_status`: not_testable (patch applies + compiles-correct by inspection, but no live device to exercise on this guest)