=== BASELINE (unfixed production code, rig unit 66:55:44:33:22:11) ===
$ su maxx -c /tmp/t2
uid=1001 euid=1001
send(HCI_CMD_RESET)   = 4 errno=0 (QUEUED-OK)
*** PRIVILEGE BYPASS: unprivileged uid queued a privileged opcode ***
send(HCI_READ_BDADDR) = 4 errno=0 (QUEUED-OK)
[kernel] cmdwait len 15 -> 17 (both unpriv commands queued on the unit)

=== WITH fix.diff (caps_priv_check(so->so_cred, SYSCAP_RESTRICTEDROOT)) ===
$ su maxx -c /tmp/t2
uid=1001 euid=1001
send(HCI_CMD_RESET)   = -1 errno=1 (Operation not permitted)
send(HCI_READ_BDADDR) = -1 errno=1 (Operation not permitted)
$ /tmp/t2        # root control
uid=0 euid=0
send(HCI_CMD_RESET)   = 4 errno=0 (QUEUED-OK)
send(HCI_READ_BDADDR) = 4 errno=0 (QUEUED-OK)
(READ_BDADDR EPERM for uid1001 on the fake unit is correct: the unit's
hci_cmds[] support bitmask is zero because the fake controller never
ran READ_LOCAL_COMMANDS; hci_security_check_opcode() requires unit
support for non-privileged sockets.)