{
  "finding_id": "DF-5735",
  "title": "READ_BUFFER_SIZE completion with max_acl_size=0 poisons unit MTU -> infinite fragmentation loop drains global mbuf pool",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "cd /root/hcih && sh build.sh",
    "run": "kldload ./hci_event_harness.ko; sysctl hw.hcih_setup=1; sysctl hw.hcih_fire_mtupoison=1",
    "expected": "hci_max_acl_size = 0 <-- POISONED; ~0.17s spin; hci_acl_send returns ENOMEM; netstat -m shows '1 requests for memory denied'"
  },
  "kernel_refs": ["sys/netbt/hci_event.c:884", "sys/netbt/hci_link.c:566", "sys/netbt/l2cap_lower.c:204"],
  "artifacts": ["harness.c", "hci_stub.c", "Makefile", "build.sh", "run.sh", "build.log", "run.log", "fix.diff", "fix_run.log", "fix_build.log", "README.md", "VERDICT.md", "verdict.json", "manifest.json", "env.txt"]
}