{
  "finding_id": "DF-2539",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "summary": "num_compl_pkts loops num_con_handles times reading 4 bytes/iteration via m_copydata with no payload-length check; malformed Number Of Completed Packets event panics the kernel deterministically (KASSERT m_copydata length > size of mbuf chain on INVARIANTS; NULL deref otherwise). Verified with a verbatim-interposition harness compiled into a NETGRAPH7+ng_hci kernel, on both the verbatim copy and the REAL ng_hci_process_event dispatch path. Fix validated A/B: well-formed events bit-identical, malformed dropped with EINVAL, no panic. Impact ceiling is kernel DoS: the walk faults at m_next==NULL, never reads adjacent heap as data, and the values read only feed clamped counters and log lines - no leak, no write, no uid0 route. Precondition: root-configured ng_hci stack (stock kernel has no netgraph); attacker is malicious/compromised BT controller firmware or dongle (or root injection on the drv hook). Medium severity stands.",
  "reproduce": {
    "build": "push trigger/ng_hci_poc.c + gen_snippet.sh to guest /usr/src/sys/netgraph7/bluetooth/hci/; sh gen_snippet.sh (verbatim extraction, sha256-gated); append conf/files entry; create X86_64_HCIPOC = X86_64_GENERIC + NETGRAPH7 + NETGRAPH7_BLUETOOTH + NETGRAPH7_BLUETOOTH_HCI + device hcipoc; make -j6 nativekernel KERNCONF=X86_64_HCIPOC; make installkernel KERNCONF=X86_64_HCIPOC DESTKERNNAME=kernel; reboot",
    "run": "sysctl -w kern.hcipoc=control ; sysctl -w kern.hcipoc=real-control ; sysctl -w kern.hcipoc=malformed (panics) ; after reset+rebuild-less reboot: sysctl -w kern.hcipoc=real-malformed (panics)",
    "expected": "control/real-control: HCIPOC PASS lines with rc=0 pending=3 acl_free=3 and invalid connection handle=2457 alert. malformed/real-malformed: panic: m_copydata: length > size of mbuf chain with num_compl_pkts frame in the trace; guest dies (DDB or wedged reboot). On the fixed kernel real-malformed prints invalid Number Of Completed Packets event, num_con_handles=255, payload=4 bytes and the guest stays up; real-control still PASS bit-identically."
  },
  "kernel_refs": [
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:878",
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:891",
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:893",
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:898",
    "sys/kern/uipc_mbuf.c:1671",
    "sys/netgraph7/bluetooth/hci/ng_hci_main.c:691",
    "sys/netgraph7/bluetooth/hci/ng_hci_main.c:749",
    "sys/netgraph7/bluetooth/include/ng_hci.h:1571"
  ],
  "poc_changes": "No seed PoC existed in findings/poc/DF-2539 - the pack was authored from scratch: kernel-compiled sysctl harness (runtime kldload GPFs on this guest), verbatim sha256-gated extraction of lines 876-932, fabricated REAL-type ng node/unit/con state, m_getcl event mbufs; real-dispatch mode added to prove the full drv-hook path; fix.diff regenerated with exact hunk counts after the first draft failed to apply.",
  "attempts": 5,
  "runtime_sec": 2700,
  "artifacts": [
    "README.md", "VERDICT.md",
    "trigger/ng_hci_poc.c", "trigger/gen_snippet.sh", "trigger/hcipoc_guest.patch",
    "build.sh", "run.sh", "fix.diff",
    "build.log", "gen_snippet.log",
    "run.control.log", "run.real-control.log", "run.malformed.log", "run.real-malformed.log",
    "fix.real-control.log", "fix.real-malformed.log",
    "panic.txt", "panic.real-malformed.txt", "panic.malformed.raw.txt",
    "dmesg.txt", "env.txt",
    "manifest.json", "verdict.json"
  ]
}