STEP: start
STEP: socket done
STEP: bind done
DOUBLE FAULT

Fatal double fault
rip = 0xffffffff806c2b4d
rsp = 0xfffff8008d1f6000
rbp = 0xfffff8008d1f6060
cpuid = 0; lapic id = 0
panic: double fault
cpuid = 0
Trace beginning at frame 0xffffffff818caec8
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
dblfault_handler() at dblfault_handler+0x10c 0xffffffff80bd682c
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

---
rip resolution (guest /boot/kernel/kernel, same build as running kernel):
  ffffffff806c2a80 T so_pru_disconnect_direct
  ffffffff806c2b00 T so_pru_listen
  => ffffffff806c2b4d = so_pru_listen+0x4d:
       callq  ffffffff8067bca0 <lwkt_domsg>
   i.e. the push of the return address for lwkt_domsg() faulted —
   the kernel stack is exhausted by the unbounded
   solisten() <-> so_pru_listen() <-> ng_btsocket_l2cap_listen() recursion.

Reproduced 3x (two independent boots, plus once inside the DF-3480 harness
driver whose first action after bind is listen()).