{
  "finding_id": "DF-3476",
  "verdict": "untested",
  "impact": "dos",
  "reproduce": {
    "build": "n/a (requires Bluetooth hardware)",
    "run": "n/a - establish RFCOMM DLC (timer armed), then race timer expiry against UA-reception/close(): remote peer sends UA exactly at the 60s DLC timeout while task holds pcb_lock, or local close() at expiry",
    "expected": "kernel wedge: softclock thread + triggering thread in permanent non-interruptible sleep ('costp'/'rf_det'), RFCOMM task halted, system degraded until reboot"
  },
  "kernel_refs": [
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3554",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c:3404",
    "sys/kern/kern_timeout.c:910"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "verdict.json", "manifest.json"]
}