{
 "finding_id": "DF-3478",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "panic",
 "confidence": "certain",
 "verdict": "Reproduced 3/3: socket(PF_BLUETOOTH,SOCK_SEQPACKET,L2CAP)+bind+listen() double-faults the kernel. ng_btsocket_l2cap_listen() (the pru_listen netmsg handler on the netisr cpu0 thread) calls DragonFlys solisten(), which itself ends with so_pru_listen() (uipc_socket.c:343) re-dispatching the same netmsg inline on the same thread \u2014 unbounded recursion exhausts the kernel stack; the return-address push for lwkt_domsg inside so_pru_listen (rip so_pru_listen+0x4d) hits an unmapped page and the CPU takes a double fault. Unprivileged (no priv check on socket/bind/listen for this family), no Bluetooth hardware needed, 100% reliable, permanent DoS until reboot. Fix (delete the solisten() call) validated on the guest: baseline panics, patched prints ALL OK and the listener then accepts connections (16M+ packets transferred through it in the follow-on harness).",
 "exploit_chain": "unpriv user: socket()->bind()->listen() -> kernel stack overflow -> double fault panic (system-wide DoS). No uid=0 route \u2014 pure availability impact.",
 "evidence": [
  "panic.txt (serial console: STEP markers then DOUBLE FAULT, rip=so_pru_listen+0x4d)",
  "VERDICT.md (full trace)",
  "step_listen.c",
  "fix.diff + patched-run STEP: ALL OK"
 ],
 "kernel_refs": [
  "sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:2460",
  "sys/kern/uipc_socket.c:343",
  "sys/kern/uipc_msg.c:351",
  "sys/kern/uipc_socket.c:259"
 ],
 "poc_changes": "harness-written (no seed); step_listen marks progress on /dev/console so the last completed syscall is visible after the panic",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 5,
 "guest_dirty": 0,
 "build_cmd": "cc -o step_listen step_listen.c",
 "run_cmd": "./step_listen  (modules netgraph.ko+ng_bluetooth.ko+ng_btsocket.ko loaded)",
 "code_hash": "f1313fe4270738223ae66c9e4f5bf5db10c5a3a8203013c32c470b0b5f89ba0c",
 "notes": "RFCOMM twin at ng_btsocket_rfcomm.c:974 and :1427 \u2014 same recursion, different file.",
 "recommended_fix": "remove the solisten() call from ng_btsocket_l2cap_listen() (syscall side already ran it before dispatch)",
 "fix_status": "fixed",
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 (ng_btsocket.ko module rebuilt with fix.diff, same base kernel)",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Baseline module: double fault at listen() (3/3). Patched module (fix.diff): listen() completes, ALL OK, listener accepts inbound L2CAP connections driven by the DF-3479/3480 harness (handshake to OPEN, accept(), 16M+ data packets). Bad behavior gone.",
 "fix_evidence": "VERDICT.md Fix validation section; patched run output STEP: listen done / STEP: ALL OK"
}