# DF-5741 — VERDICT

**Reproduced: yes — deterministic (not a race).**
Unprivileged uid 1001 opened a raw HCI socket through the verbatim
production `hci_sattach` and queued `HCI_CMD_RESET` (a privileged-only
opcode; the hci_cmds[] security table marks it length -1) with errno=0.
Kernel state confirmed the command landed on `unit->hci_cmdwait`
(harness state dump 15→17).  No special timing.

**Root cause (both arms of the check grant):**
- hci_socket.c:644 `curproc == NULL` — true on the netisr port thread;
- `caps_priv_check_self()` → `caps_priv_check_td(curthread)` →
  kern_caps.c:348 `if (td->td_lwp == NULL) return 0;` — true for the
  netisr thread.  The imported NetBSD code assumed pru_attach executes
  on the user's syscall thread; DragonFly's netmsg port serialization
  moved it.

**Impact**: security-filter bypass — unprivileged local user gains
full HCI controller command access + privileged event/packet tap
(including link-key/passkey disclosure events) on any machine with a
Bluetooth controller.  Also disables the five privilege gates in
hci_ioctl.c (reached via hci_scontrol from this file).

**Fix validated**: `caps_priv_check(so->so_cred, SYSCAP_RESTRICTEDROOT)`
(credential captured from the creating user thread in socreate) —
after the fix: uid1001 → EPERM on RESET; uid0 → unchanged
(`run.log` second half).  The same conversion should be applied to
hci_ioctl.c:224,249,259,273,287 (out of this file's scope; noted).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.