{
  "finding_id": "DF-5734",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "A single well-formed 8-byte HCI Num_Compl_Pkts event drives hci_event_num_compl_pkts() (sys/netbt/hci_event.c:380-405) into hci_acl_complete() (sys/netbt/hci_link.c:708-748), whose completion loop makes no progress when the links head PDU has lp_pending==0 with data queued (routine state while controller buffers are full): num -= 0 forever, the bluetooth NETISR thread spins holding the mplock, and the guest becomes totally unresponsive (no panic, recovery only by reset). Distinct from the pass-1 parse-loop findings (DF-0558/0559/0560/0561): this is a completion-accounting state-machine defect triggered by a WELL-FORMED event. Fix (no-progress guard + lc_pending underflow guard) validated on the guest: identical trigger returns cleanly and the guest stays alive.",
  "exploit_chain": "",
  "evidence": "run.log: console sequence (pre-fire state lp_pending=0/qlen=1 -> inject -> silence) + ssh banner timeouts + vm.sh status down; VERDICT.md: verbatim-build md5s and state-transition proof of the guard; fix_run.log: SYSCTL_RC=0 + ALIVE_AFTER_3S on patched build; fix_guard_panic_serial.txt: guard reached in netisr context (fault in its kprintf arg evaluation)",
  "kernel_refs": [
    "sys/netbt/hci_event.c:380",
    "sys/netbt/hci_event.c:393",
    "sys/netbt/hci_link.c:708",
    "sys/netbt/hci_link.c:716",
    "sys/netbt/hci_link.c:734",
    "sys/netbt/bt_input.c:31",
    "sys/netbt/hci_unit.c:329"
  ],
  "poc_changes": "harness wrote m_copyback2 results inside KKASSERT() which is a no-op without INVARIANTS - copyback never ran; replaced with real error checks. netisr_register needs 3 args on this tree. Stubbed l2cap_send_{connect_req,connect_rsp,config_req} and sco_detach for the verbatim link layer.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 92,
  "guest_dirty": 1,
  "build_cmd": "cd /root/hcih && sh build.sh (copies verbatim /usr/src/sys/netbt hci_event.c hci_link.c hci_misc.c hci_unit.c bt_input.c; make -m /usr/src/share/mk SYSDIR=/usr/src/sys)",
  "run_cmd": "kldload ./hci_event_harness.ko; sysctl hw.hcih_setup=1; sysctl hw.hcih_arm_pdu=1; sysctl hw.hcih_fire_numcompl=1  (expect: console silence after injection marker + guest wedge)",
  "code_hash": "6340c3ed50778a7ea7133e8ec729aab6f9f8b2ca8a970e190ca2b981a2c7e4a6",
  "notes": "netbt is optional (not in GENERIC): reachable on kernels built with device bluetooth plus any HCI controller. Adjacent lc_pending uint8_t underflow (hci_link.c:734) fixed in same hunk. Netisr-context kprintf output is dropped by the console layer on this guest - guard execution proven by state transition + intermediate-build panic.",
  "recommended_fix": "hci_acl_complete(): return when the head PDU has lp_pending==0 (no-progress guard); guard chan->lc_pending decrement against underflow",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "With fix.diff applied to /usr/src/sys/netbt and the harness rebuilt against the patched sources, the identical trigger completes (SYSCTL_RC=0) and the guest stays alive; the armed PDU transitions lp_pending 0->1/qlen 1->0 via the guard-return + hci_acl_start path, proving the new early-return executes; normal completion of a pending PDU still works.",
  "fix_evidence": "fix_run.log (F1 FIXED RUN block: SYSCTL_RC=0, ALIVE_AFTER_3S, subsequent triggers on same boot); fix_guard_panic_serial.txt (guard kprintf arg evaluation fault = guard reached in netisr context)"
}