{
  "finding_id": "DF-5736",
  "status": "reproduced",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "hci_event_inquiry_result/hci_event_rssi_result (sys/netbt/hci_event.c:463,500) call hci_memo_new() for every response with no allocation cap; hci_memo_new (sys/netbt/hci_misc.c:145) allocates ~48B per unique bdaddr and reclamation is lookup-lazy (hci_misc.c:124, 600s expiry, no sweep). Guest: 3 bursts of 2048 unique-address responses grew the list monotonically 0->1436->2848->3184 memos (vmstat -m Bluetooth 150K), ~70-90% of responses accepted past the hci_eventq_max=20 backpressure. Remotely seedable via inquiry-response spoofing; controller injection runs at USB speed. Fix (per-unit cap hci_memo_max=1024) validated: growth stops at exactly 1024, 0 allocated on subsequent floods.",
  "exploit_chain": "",
  "evidence": "run.log: memos before/after sequence 0->1436->2848->3184 across three fires + vmstat -m Bluetooth 150K; fix_run.log: capped at 1024 with allocated 0 on repeat floods",
  "kernel_refs": [
    "sys/netbt/hci_event.c:463",
    "sys/netbt/hci_event.c:500",
    "sys/netbt/hci_misc.c:145",
    "sys/netbt/hci_misc.c:124"
  ],
  "poc_changes": "none beyond the shared-rig fixes (copyback error checks)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cd /root/hcih && sh build.sh",
  "run_cmd": "kldload ./hci_event_harness.ko; sysctl hw.hcih_setup=1; sysctl hw.hcih_fire_memo=1 (x3)",
  "code_hash": "08502b7aa397b853bf70e73ab2b12196da8846f71d53d9bd6cd2064360ab0ec1",
  "notes": "Distinct from DF-0559 (KKASSERT parse guards on short packets): this is the allocation policy for WELL-FORMED result events. Backpressure (hci_eventq_max=20) is the only rate limiter; it passed ~70-90% under a single-threaded flood.",
  "recommended_fix": "cap the per-unit memo cache (hci_memo_max sysctl, default 1024) in hci_memo_new()",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "With the cap hunk applied, the same three-burst flood stops at exactly 1024 memos (allocated 0 on subsequent floods); guest alive and other triggers functional on the same boot.",
  "fix_evidence": "fix_run.log (F3 FIXED RUN block: memos after: 1024 / 1024 / 1024, allocated 0 on repeats)"
}