{
  "verdict": "reproduced",
  "impact": "panic",
  "finding": "DF-5738: hci_link_free() ignores the SCO->ACL anchor reference (hl_link from production hci_acl_open(), hci_link.c:810) -- tearing down an anchored ACL link leaves hl_refcnt==1: KKASSERT panic on INVARIANTS kernels, silent kfree + dangling SCO->hl_link (UAF, demonstrated fatal trap in hci_link_free) on production GENERIC kernels",
  "reproduce": {
    "build": "cd /root/hcih && sh build.sh && kldload ./hci_link_harness.ko",
    "run": "sysctl hw.hlh_setup=1; sysctl hw.hlh_sco_anchor=1; sysctl hw.hlh_fire_discon=2; sysctl hw.hlh_uaf=1",
    "expected": "control (SCO-first) clean; fire: ACL link freed with anchor live -> SCO teardown events -> Fatal trap 12, supervisor write fault in hci_link_free (panic.txt); INVARIANTS kernels stop earlier at KKASSERT(hl_refcnt==0) hci_link.c:952"
  },
  "kernel_refs": [
    "sys/netbt/hci_link.c:810",
    "sys/netbt/hci_link.c:943",
    "sys/netbt/hci_link.c:952",
    "sys/netbt/hci_link.c:979",
    "sys/netbt/hci_event.c:629",
    "sys/netbt/hci_event.c:1046",
    "sys/netbt/sco_upper.c:160",
    "sys/sys/systm.h:98"
  ],
  "artifacts": [
    "harness.c", "hci_stub.c", "stub.h", "Makefile", "build.sh", "run.sh",
    "fixbuild.sh", "build.log", "run.log", "panic.txt", "fix.diff",
    "fix_run.log", "env.txt", "verdict.json", "manifest.json"
  ]
}