{
  "finding_id": "DF-3513",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "NG_BT_ITEMQ_DRAIN frees queued items with flag-only NG_FREE_ITEM, never dropping the reference taken by ng_ref_item at enqueue; every packet queued in an HCI connections conq at destruction time permanently leaks the ng_item, its mbuf, and node/hook references. Live-verified: 20000 attack rounds (unprivileged, uid 65534) exhausted the 4096-entry netgraph item objcache (Warning: objcache(netgraph) exhausted on cpu0!, ENOMEM error=12) and wedged the guest; the one-line ng_unref_item fix yields clean 3000/20000-round runs with flat memory and zero warnings.",
  "exploit_chain": "admin wires a bluetooth graph (or a real BT controller is present) -> unprivileged user writes HCI events/ACL data via ng7 data socket (no priv check at attach) -> ConCompl opens con, 2nd ACL packet flow-controls in conq, DisconCompl frees con -> drained item leaks -> repeat -> objcache exhaustion + netgraph-wide ENOMEM; leaked node refs additionally drive the DF-3514 rehash panic",
  "evidence": "run.log baseline section (objcache exhausted, guest wedged) vs fixed section (done: 3000 rounds, flat netgraph count, 0 warnings); fix.diff validated by guest module rebuild",
  "kernel_refs": [
    "sys/netgraph7/bluetooth/include/ng_bluetooth.h:202-213",
    "sys/netgraph7/netgraph.h:816-820",
    "sys/netgraph7/bluetooth/hci/ng_hci_misc.c:320",
    "sys/netgraph7/bluetooth/hci/ng_hci_main.c:873",
    "sys/netgraph7/bluetooth/hci/ng_hci_evnt.c:674"
  ],
  "poc_changes": "full ng7 socket ABI written from scratch (no ngctl in guest): MKPEER/NAME/CONNECT wiring, data-socket binding via connect(), token-matched replies; NGM_HCI_NODE_INIT bdaddr gate bypassed in guest-local module copy because DF-3515 wedges the CC handshake (measurement scaffolding only, documented in VERDICT.md)",
  "attempts": 12,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 5400,
  "guest_dirty": 1,
  "build_cmd": "sh build.sh",
  "run_cmd": "sh run.sh",
  "code_hash": "3598eb027221bc1a42146ee293e3997bea2cc0ddf930bffb66fff84e9f902aef",
  "notes": "leak pins ng_node refs -> feeds DF-3514 panic chain; independent DF-3515 (callout_stop returns 0) blocked the stock READY path, bypassed locally for measurement",
  "recommended_fix": "NG_BT_ITEMQ_DRAIN: add ng_unref_item(i, 0) after NG_FREE_ITEM(i) (+ refcount/netgraph2 includes at the instantiation site)"
}