--- a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c
+++ b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c
@@ -2435,8 +2435,6 @@
 ng_btsocket_l2cap_listen(netmsg_t msg)
 {
 	struct socket		*so = msg->listen.base.nm_so;
-	struct thread		*td = msg->listen.nm_td;
-	int			 backlog = msg->listen.nm_flags; /* XXX */
 	ng_btsocket_l2cap_pcb_p	 pcb = so2l2cap_pcb(so);
 	int			 error = 0;
 
@@ -2457,7 +2455,15 @@
 		error = EADDRNOTAVAIL;
 		goto out;
 	}
-	solisten(so, backlog, td);
+	/*
+	 * DO NOT call solisten() here: on DragonFly the listen(2) path
+	 * already ran it on the syscall side (kern_listen() -> solisten()
+	 * sets SO_ACCEPTCONN/so_qlimit and THEN calls so_pru_listen(),
+	 * which dispatches to this handler).  Calling solisten() again
+	 * re-enters so_pru_listen() and recurses without bound (inline
+	 * dispatch on the netisr cpu0 port) until the kernel stack
+	 * overflows -> double fault -> unprivileged kernel panic.
+	 */

 out:
 	lwkt_replymsg(&msg->listen.base.lmsg, error);