{
 "finding_id": "DF-3490",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Not testable at runtime on this guest (no USB Bluetooth dongle can be attached to attach/detach ng_ubt nodes; malicious-USB threat model). Line-accurate confirmation: ubt_detach() (ng_ubt.c:684-713) drains sc_cmdq/sc_aclq/sc_scoq via NG_BT_MBUFQ_DESTROY but never frees sc->sc_isoc_in_buffer and never clears it - the only other reference in the file is ubt_isoc_read_one_frame() retaining it (:1113, :1178); grep of the whole tree shows no other user. Every attach/detach cycle that leaves a partial SCO frame in the reassembly mbuf therefore leaks one mbuf+cluster (~2KB) permanently; repeated hotplug cycles drive toward mbuf exhaustion. ng7 ubt is compiled into the DF verification harness kernel (NETGRAPH7_BLUETOOTH_UBT) to prove the file builds and the fix.diff applies (see build.log in the harness kernel log); runtime leak not exercised - no device.",
 "evidence": "source excerpt ng_ubt.c:684-713 (detach) and :1113/:1178 (retention), harness kernel build.log (module compiled in)",
 "kernel_refs": [
  "sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:684",
  "sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1113",
  "sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1178"
 ],
 "poc_changes": "none",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "harness kernel: make nativekernel KERNCONF=X86_64_NG7 (includes NETGRAPH7_BLUETOOTH_UBT)",
 "run_cmd": "n/a (hardware-gated)",
 "code_hash": null,
 "notes": "fix_status: not_testable (no USB dongle). Compile-validation via harness kernel inclusion.",
 "recommended_fix": "NG_FREE_M(sc->sc_isoc_in_buffer) under UBT_NG_LOCK in ubt_detach() (and clear on disconnect)."
}