{
 "finding_id": "DF-3512",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Hardware-gated, not testable on this guest (node exists only when a 3Com 3CRWB609 PC Card is attached; QEMU provides no PCMCIA bt3c). Line-accurate confirmation: ng_bt3c_rcvmsg's NGM_BT3C_NODE_GET_QLEN handler (ng_bt3c_pccard.c:435-466) reads ((ng_bt3c_node_qlen_ep *)(msg->data))->queue at :444 with NO arglen check, while the sibling SET_QLEN (:467) and SET_DEBUG (:419) both validate - confirmed by source. A binary GET_QLEN with arglen < 1 reads one byte past the kmalloc'd ng_mesg; value only selects a response branch (no disclosure); panic potential only at hardened allocator boundaries. The file compiles in the harness kernel (NETGRAPH7_BLUETOOTH_BT3C) proving fix.diff applies (harness build.log).",
 "evidence": "source excerpt :419/:435-466/:467, harness kernel build (bt3c compiled in)",
 "kernel_refs": [
  "sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:444",
  "sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c:467"
 ],
 "poc_changes": "none",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "make nativekernel KERNCONF=X86_64_NG7   # includes NETGRAPH7_BLUETOOTH_BT3C",
 "run_cmd": "n/a (no PCMCIA hardware)",
 "code_hash": null,
 "notes": "fix_status: not_testable (hardware).",
 "recommended_fix": "add 'if (msg->header.arglen != sizeof(ng_bt3c_node_qlen_ep)) ERROUT(EMSGSIZE);' to GET_QLEN."
}