{
  "finding_id": "DF-2539",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Reproduced on both the verbatim-extracted function and the REAL ng_hci_process_event dispatch path: a Number Of Completed Packets event with num_con_handles=255 but a single (handle,pkt) pair drives the unvalidated loop at ng_hci_evnt.c:891 past the end of the event mbuf chain and panics the kernel in m_copydata (INVARIANTS KASSERT length > size of mbuf chain; NULL deref on non-INVARIANTS). Well-formed control events behave exactly per real struct semantics (pending/buffer counters applied, unknown handle alert). fix.diff validated A/B: well-formed events bit-identical, malformed dropped with EINVAL before any state change, no panic. Impact ceiling is kernel DoS: the chain walk faults at m_next==NULL and never reads adjacent heap as data; the values read only feed clamped counters and log lines - no leak, no write primitive, no uid0 route. Precondition: root-configured netgraph7 ng_hci stack (stock kernel ships no netgraph); attacker is malicious or compromised BT controller firmware / dongle, or root injecting on the drv hook. Medium severity stands.",
  "exploit_chain": "",
  "evidence": "panic.txt (verbatim copy panic: m_copydata: length > size of mbuf chain, num_compl_pkts frame in trace); panic.real-malformed.txt (same panic via REAL ng_hci_process_event, dump taken, guest dead); run.control.log + run.real-control.log (PASS: rc=0 pending=3 acl_free=3, invalid connection handle=2457); fix.real-malformed.log (invalid Number Of Completed Packets event, num_con_handles=255, payload=4 bytes - dropped, guest up); fix.real-control.log (bit-identical PASS on fixed kernel); gen_snippet.log (sha256 attestation of the 57-line verbatim extraction, proof ng_hci_evnt.c:891 is the loop head); build.log (full untrimmed build, -Werror clean); dmesg.txt (boot attestation + all test lines)",
  "kernel_refs": [
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:878",
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:891",
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:893",
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:898",
    "sys/kern/uipc_mbuf.c:1671",
    "sys/netgraph7/bluetooth/hci/ng_hci_main.c:691",
    "sys/netgraph7/bluetooth/hci/ng_hci_main.c:749",
    "sys/netgraph7/bluetooth/include/ng_hci.h:1571"
  ],
  "poc_changes": "Authored from scratch (no seed pack): kernel-compiled sysctl harness because runtime kldload GPFs on this guest and stock kernels ship no netgraph; sha256-gated verbatim extraction of ng_hci_evnt.c lines 876-932; fabricated state uses REAL ng_hci types with REAL linked-in ng_hci_con_by_handle/ng_hci_send_data; added real-dispatch modes to prove the full drv-hook path; fix.diff hunk counts regenerated after the first draft failed patch(1) validation",
  "attempts": 5,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Mon Oct 19 22:08:10 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_HCIPOC x86_64 (baseline panic kernel: #0 Mon Oct 19 21:40:32 UTC 2026)",
  "runtime_sec": 2700,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_HCIPOC && make installkernel KERNCONF=X86_64_HCIPOC DESTKERNNAME=kernel",
  "run_cmd": "sysctl -w kern.hcipoc=control ; sysctl -w kern.hcipoc=real-control ; sysctl -w kern.hcipoc=malformed ; sysctl -w kern.hcipoc=real-malformed",
  "code_hash": "560407877eff19f3b0aa0208872a60724200f4cc87864911b7a54819208b7518",
  "notes": "Sibling bug, same class/file, NOT re-filed in verify mode: inquiry_result (ng_hci_evnt.c:373, loop at :387) walks num_responses x 14 bytes unvalidated via m_copydata/mtod - same panic from a malformed Inquiry Result event; same guard style fixes it. hdr->length is never validated by ng_hci_process_event either. Guest was reset with-src and the mid-run hcipoc-baseline snapshot deleted before returning.",
  "recommended_fix": "In num_compl_pkts, after m_adj of the event parameters header, drop the event with EINVAL unless m_pkthdr.len >= num_con_handles * 4 (see fix.diff); apply the same guard to inquiry_result."
}