{
 "finding_id": "DF-5743",
 "status": "untested",
 "reproduced": false,
 "verdict": "Low/hardening: hci_socket.c:991 and hci_unit.c:347/363/380 use IFF_LINK0 (0x1000) as an mbuf direction tag; it collides with the core mbuf flag M_LASTFRAG (mbuf.h:256), which is copied by m_copym (M_COPYFLAGS, mbuf.h:282). Every RX packet gets a spurious M_LASTFRAG; every frag-flagged mbuf entering hci_mtap is misreported as incoming in the SCM_HCI_DIRECTION cmsg. No in-tree consumer of M_LASTFRAG touches netbt mbufs (bge/bnx/ti/wpi/ip_output/ieee80211 only), so no demonstrable impact today - filed as hardening with a spoofable-metadata note.",
 "impact": "none",
 "confidence": "certain",
 "exploit_chain": "",
 "evidence": "static: sys/netbt/hci_socket.c:991, sys/netbt/hci_unit.c:347, sys/net/if.h:104, sys/sys/mbuf.h:256, sys/sys/mbuf.h:282, consumers enumerated via grep (no netbt-path consumer)",
 "kernel_refs": [
  "sys/netbt/hci_socket.c:991",
  "sys/netbt/hci_unit.c:347",
  "sys/net/if.h:104",
  "sys/sys/mbuf.h:256"
 ],
 "poc_changes": "not built - Low/hardening finding, verification skipped per audit contract",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": "",
 "run_cmd": "",
 "code_hash": "n/a",
 "notes": "verified by source analysis only (flag value collision + consumer enumeration); no runtime impact reachable",
 "recommended_fix": "stop borrowing IFF_LINK0 for mbufs: add a netbt-private direction indicator (separate m_flag bit coordinated with sys/sys/mbuf.h maintainers, or a pkthdr aux field).",
 "fix_status": "not_tested",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "hardening-only finding; no fix validation applicable",
 "fix_evidence": ""
}