{
  "finding_id": "DF-3515",
  "title": "callout_stop returns 0 for inline-completed stops (kern_timeout) -> ng7 ng_uncallout contract broken; ng_callout/ng_uncallout item+noderef leaks",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "instrumented ng7 core+hci modules (kprintf probes) or stock: run DF-3513 poc handshake",
    "run": "./poc_leak 3 ; observe state stuck 0x5, bdaddr zeros, NODE_INIT ENXIO; instrumented: UNC rval=0 with valid armed toc",
    "expected": "complete_command always takes silent ETIMEDOUT path; HCI unit never initializes; callout items+node refs leak both paths"
  },
  "kernel_refs": [
    "sys/kern/kern_timeout.c:888-901",
    "sys/netgraph7/netgraph/ng_base.c:3248-3296"
  ],
  "artifacts": ["README.md","VERDICT.md","fix.diff","fix.diff.ng7","manifest.json","verdict.json"]
}