# DF-5740 — hci_socket.c sockbuf mutation from the NETISR thread (hci_mtap sbappendaddr / hci_drop sbdroprecord) + post-detach hci_drop UAF

Production code: `sys/netbt/hci_socket.c` (md5 50bdf81bf0b8828ce1336511b98e3c52,
compiled VERBATIM into the rig; see `setup.log`).

## What this pack contains

* `harness.c`, `sock_stub.c`, `stub.h`, `Makefile`, `build.sh` — the
  production-code KLD rig ("hci_sock_harness"): compiles
  hci_socket.c / hci_event.c / hci_link.c / hci_misc.c / hci_unit.c /
  bt_input.c / bt_proto.c unmodified, registers the real AF_BLUETOOTH
  domain (so plain userland `socket(AF_BLUETOOTH, SOCK_RAW,
  BTPROTO_HCI)` exercises production `hci_sattach`/`hci_ssend`/
  `hci_sdetach`), attaches a fake controller unit via production
  `hci_attach()` with `hci_num_cmd_pkts = 0`, and injects
  Command_Complete events through production `hci_input_event()` from a
  kernel thread pinned to **CPU 3**.
* `trigger.c` — userland: opens N promiscuous full-filter tap sockets
  (with `SO_HCI_DIRECTION` to widen the per-copy window), then loops
  {open HCI socket, raise SO_SNDBUF, connect(unit), send K commands,
  drain taps, close}.  Optional `DF5740_FEEDER=1` adds a second
  open/send/close thread to multiply freed-socket-slot reuse.
* `run.sh` — the exact orchestration (load, setup, baseline, race).
* `panic.txt` — the decisive `panic: receive 1` backtrace + earlier
  crash/wedge evidence.
* `race3/4/5.log`, `fix_run.log` — trigger-side outputs.
* `build.log`, `setup.log`, `env.txt`, `code_hashes.txt`.
* `fix.diff` — the verified fix (sockbuf tokens + ctx-owned socket
  reference + devlock-guarded ctx consume).

## Build (inside the guest, as root)

```
sh build.sh          # copies /usr/src/sys/netbt/*.c VERBATIM (md5s in
                     # setup.log), builds hci_sock_harness.ko + trigger
```

## Run (inside the guest, as root)

```
kldload ./hci_sock_harness.ko
sysctl hw.hsh_setup=1                    # attach unit + CPU3 injector
sysctl debug.trace_on_panic=1 debug.debugger_on_panic=0
# race:
sysctl hw.hsh_fire=99999 &               # paced completion flood, cpu3
DF5740_FEEDER=1 ./trigger 8000 6 200     # open/send/close + taps, any cpu
```

## Expected result (unfixed production code)

Kernel panic `panic: receive 1` in `soreceive()` (sockbuf accounting
desync between `hci_mtap`'s `sbappendaddr` on the netisr port and the
user thread inside `soreceive`) — observed at 24 s on the rig — or, on
production (non-KASSERT) kernels, silent sockbuf corruption: lost
records with live `ssb_cc` (permanent sosend/soreceive stalls —
`race5.log` shows 96 non-EWOULDBLOCK send failures accumulating),
stale `sb_lastrecord` writes into freed mbufs, record theft from
reallocated sockets (the post-detach `hci_drop()` UAF), mbuf
double-frees, and hard system wedges (`race4.log`, `race5.log`,
`send_ipiq ... tgt not draining` in `panic.txt`).

## Expected result (with fix.diff applied to /usr/src/sys/netbt and the
rig rebuilt — identical race load)

No panic, no wedge, zero send failures; the run survives ≥4× the
exposure that panicked the unfixed kernel (`fix_run.log`: 425+
iterations clean vs baseline panic at ~100–150 iterations, stopped
manually).  `fix.diff` was validated exactly this way.