# DF-3512 - VERDICT

**status: inconclusive | reproduced: 0 | impact: none | confidence: certain**

Hardware-gated, not testable on this guest (node exists only when a 3Com 3CRWB609 PC Card is attached; QEMU provides no PCMCIA bt3c). Line-accurate confirmation: ng_bt3c_rcvmsg's NGM_BT3C_NODE_GET_QLEN handler (ng_bt3c_pccard.c:435-466) reads ((ng_bt3c_node_qlen_ep *)(msg->data))->queue at :444 with NO arglen check, while the sibling SET_QLEN (:467) and SET_DEBUG (:419) both validate - confirmed by source. A binary GET_QLEN with arglen < 1 reads one byte past the kmalloc'd ng_mesg; value only selects a response branch (no disclosure); panic potential only at hardened allocator boundaries. The file compiles in the harness kernel (NETGRAPH7_BLUETOOTH_BT3C) proving fix.diff applies (harness build.log).

## Kernel references
- sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:444
- sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:467

## Evidence
source excerpt :419/:435-466/:467, harness kernel build (bt3c compiled in)

## Recommended fix
add 'if (msg->header.arglen != sizeof(ng_bt3c_node_qlen_ep)) ERROUT(EMSGSIZE);' to GET_QLEN.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.