{
  "finding_id": "DF-3477",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced on the guest: uid=1001 successfully bind(2)s a PF_BLUETOOTH SOCK_SEQPACKET L2CAP socket to reserved service PSMs 1 (SDP) and 3 (RFCOMM) \u2014 ng_btsocket_l2cap_bind() contains no priv_check and no PSM range restriction \u2014 and a second bind of the same PSM returns EADDRINUSE, demonstrating occupation semantics. Impact ceiling is local Bluetooth service impersonation/squatting on systems with the ng_btsocket stack loaded and a BT adapter (no kernel memory-safety impact; the impact enum has no service-hijack value, hence none).",
  "exploit_chain": "socket(PF_BLUETOOTH, SOCK_SEQPACKET, BLUETOOTH_PROTO_L2CAP) -> bind(PSM 1) as unprivileged user -> listen() [with DF-3478 fixed] -> ng_btsocket_l2cap_pcb_by_addr() delivers every inbound connection for that PSM to the attackers listener instead of the system service",
  "evidence": [
    "README.md",
    "df3477_bind.c",
    "run.log (uid=1001 bind(psm=1) SUCCESS / bind(psm=3) SUCCESS / second bind(psm=1) EADDRINUSE)"
  ],
  "kernel_refs": [
    "sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2037",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2076",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2679"
  ],
  "poc_changes": "none \u2014 seed was accurate",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "cc -o df3477_bind df3477_bind.c",
  "run_cmd": "su -m nobody -c ./df3477_bind   (modules: netgraph.ko ng_bluetooth.ko ng_btsocket.ko loaded)",
  "code_hash": "TBD",
  "notes": "PSM byte order on the wire is little-endian but le16toh() is a no-op on LE hosts \u2014 the PoC passes the native u16 value. Related: DF-0499 (raw node ioctls, same missing-privilege family).",
  "recommended_fix": "priv_check() privileged/binding user for assigned PSMs (< 0x1001) in ng_btsocket_l2cap_bind()"
}