{
  "finding_id": "DF-3515",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "kern_timeouts _callout_cancel_or_stop returns 0 when the STOP request is completed inline (SET cleared by _callout_update_spinlocked, PREVENTED set), violating the documented returns 1 if responsible contract; netgraph7s ng_uncallout therefore reports failure for successful cancellations, so every ng7 timer consumer misbehaves \u2014 demonstrated live: HCI Read_BD_ADDR Command_Complete always dropped via the silent ETIMEDOUT path, unit wedged in COMMAND_PENDING forever, bluetooth stack cannot initialize. ng_callout additionally leaks the overwritten callout item (oitem) and ng_uncallout leaks the cancelled item via flag-only NG_FREE_ITEM; both pin ng_node references (DF-3514 feedstock).",
  "exploit_chain": "armed callout + cancel -> callout_stop()==0 -> ng_uncallout reports not-cancelled -> caller takes timeout path while callout is actually stopped -> state machines wedge + items/noderefs leak permanently",
  "evidence": "VERDICT.md: ARM/CC/UNC/UT kprintf probe output captured on guest (rval=0 with toc valid, func=trampoline); state probes 0x5 stuck; bdaddr zeros",
  "kernel_refs": [
    "sys/kern/kern_timeout.c:888-901",
    "sys/netgraph7/netgraph/ng_base.c:3248-3296",
    "sys/netgraph7/bluetooth/hci/ng_hci_cmds.c:368-369",
    "sys/netgraph7/bluetooth/hci/ng_hci_misc.c:390-392"
  ],
  "poc_changes": "kernel-side probes added to guest-local module copies (ARM/UNC/UT kprintf); no workspace changes",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 900,
  "guest_dirty": 1,
  "build_cmd": "guest-local instrumented module builds",
  "run_cmd": "./poc_leak 3 (handshake stage) + GET_STATE/GET_BDADDR probes",
  "code_hash": "",
  "notes": "kern_timeout.c fix authored (fix.diff) but not kernel-rebuilt (time budget); ng7-side fix module-validated within DF-3514s 20-run survival test",
  "recommended_fix": "kern_timeout: report PREVENTED in the inline-completed early exit; ng7: ng_free_item for callout items (oitem overwrite + cancelled item)"
}