{
  "finding_id": "DF-3480",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "The missing-lock defect is proven by inspection: ng_btsocket_l2cap_data_input calls sbappendrecord() on so_rcv (ng_btsocket_l2cap.c:1455/:1529) from the taskqueue_swi thread holding only pcb_lock/sockets_lock, while soreceive performs record unlink surgery on the same sockbuf under so_rcv.ssb_token (uipc_socket.c:1683/1831) — no common lock. Runtime: after applying the DF-3478 and DF-3479 fixes (required to make the inbound path work at all), the btsbx harness drove an inbound connection to OPEN and raced ~2x10^7 accepted appends against 8 concurrent readers for ~10 minutes across several runs. No kernel corruption/panic was captured; however a reproducible anomaly was demonstrated that is inconsistent with a serialized sockbuf: readers performed single-digit total reads then slept forever while FIONREAD reported 4352 queued bytes and a fresh select()+read() succeeded (lost-wakeup/torn-tail signature). Filed as likely with the corruption ceiling unproven; demonstrated impact is silent data loss and a permanently wedged socket.",
  "exploit_chain": "",
  "evidence": ["README.md (lock analysis path:line)", "run.log (16.8M appends, 9 reads, FIONREAD=4352 anomaly)", "btsbx.c + df3478_drive.c + Makefile (harness)"],
  "kernel_refs": ["sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1455", "sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1529", "sys/kern/uipc_sockbuf.c:176", "sys/kern/uipc_socket.c:1831"],
  "poc_changes": "harness-written (no seed); required fixing DF-3478 and DF-3479 first to reach the vulnerable code at all",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 660,
  "guest_dirty": 0,
  "build_cmd": "make (btsbx.ko); cc -pthread -o df3478_drive df3478_drive.c",
  "run_cmd": "./df3478_drive 240 8   (after sysctl debug.btsbx.cmd handshake steps 1..4)",
  "code_hash": "7921bc23301891379db8c5bf4d66e5f074c108dbaac7f44546fc127a324f0176",
  "notes": "The same caller-must-serialize sockbuf assumption is violated by the so_snd side (send/write_rsp/process_timeout under pcb_lock only). Guest was left wedged by the final run and reset with-src afterwards.",
  "recommended_fix": "take so_rcv.ssb_token around sbappendrecord+sorwakeup in ng_btsocket_l2cap_data_input (both paths)"
}