--- a/sys/netbt/hci_socket.c
+++ b/sys/netbt/hci_socket.c
@@ -641,7 +641,17 @@
 	so->so_pcb = pcb;
 	pcb->hp_socket = so;
 
-	if (curproc == NULL || caps_priv_check_self(SYSCAP_RESTRICTEDROOT) == 0)
+	/*
+	 * Fix (DF-5741): this handler runs as a netmsg on the socket's
+	 * protocol (netisr) port, where curproc is NULL and
+	 * caps_priv_check_self() evaluates the NETISR THREAD's context
+	 * (a kernel thread has no lwp, and caps_priv_check_td() grants
+	 * privilege to lwp-less threads unconditionally) -- so BOTH
+	 * arms of the old check granted HCI_PRIVILEGED to every socket,
+	 * for any user.  Check the credentials the socket was CREATED
+	 * WITH (captured from the user thread in socreate()) instead.
+	 */
+	if (caps_priv_check(so->so_cred, SYSCAP_RESTRICTEDROOT) == 0)
 		pcb->hp_flags |= HCI_PRIVILEGED;
 
 	/*