# DF-5742 — hci_mtap() taps into receive buffers with no flow control:
unbounded mbuf accumulation -> global mbuf-pool exhaustion (kernel-wide
allocation failure / hard hang)

Production code: `sys/netbt/hci_socket.c:1003-1010`
```c
m0 = m_copym(m, 0, M_COPYALL, M_NOWAIT);
if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv.sb, &sa, m0, ctlmsg))
        sorwakeup(pcb->hp_socket);
```
`sbappendaddr()` checks no high-water mark; `ssb_cc`/`ssb_mbcnt` grow
without bound for a socket that never reads.  Every HCI packet (event,
command, ACL, SCO) that passes a tap socket's filters is copied into
its receive queue.  A raw HCI socket that stops reading (or a handful
of them) turns the Bluetooth stack into an unbounded consumer of the
GLOBAL mbuf pool: every kernel allocation needing an mbuf pkthdr fails
system-wide (network, VM paging paths, ...), observed live as
"Warning: objcache(mbuf pkthdr) exhausted" on ALL CPUs followed by an
unrecoverable hard hang of the whole guest (`exhaustion.txt`,
`race4.log`, `race5.log`).

Reachability: raw HCI sockets are unprivileged; on this kernel every
socket is even HCI_PRIVILEGED (DF-5741), so an unprivileged user can
(1) open N promiscuous sockets with full packet+event filters via
setsockopt and simply never read, and (2) generate the traffic himself
(sending commands produces Command Complete/Status events that are
tapped).  No controller traffic from other users needed; no race; no
timing.

The evidence in this pack was recorded during the DF-5740 race rig
iterations whose taps were not draining (the first crash
investigation, before the taps were made to drain, was in fact CAUSED
by this bug, not by the DF-5740 race - see DF-5740/panic.txt's confound
note; both point at the same run family).

## Reproduce
Load the DF-5740 rig, `sysctl hw.hsh_setup=1`, then run its trigger
with taps that never read, e.g. `./trigger 100 48 40` (taps are only
drained at the end) while `sysctl hw.hsh_fire=99999` floods
completions.  Expected: exhaustion warnings on all CPUs within tens of
seconds, then system-wide allocation failure/hang.

## Fix (proposed, NOT runtime-validated separately)
`fix.diff`: skip sockets whose receive buffer has no space
(`ssb_space()` check before sbappendaddr), mirroring what every other
tap/protocol does.  Authored after the mechanism was confirmed; not
separately rebuilt on the guest (the class is resource exhaustion, not
memory corruption), so mark untested.