{
  "finding_id": "DF-5748",
  "title": "Dead callout_active()/RFCOMM_DLC_DETACH deferred-free machinery in rfcomm_detach() under DragonFly callout semantics",
  "verdict": "reproduced",
  "impact": "none",
  "reproduce": {
    "build": "cd /root/rfup/DF-5748 && ./build.sh",
    "run": "cd /root/rfup/DF-5748 && ./run.sh && dmesg | tail   (~25 s incl. session-expiry sleep)",
    "expected": "[DF-5748] A timer: pending=1 active=1 (ARMED) then after rfcomm_dlc_close(): pending=0 active=0 -> '[DF-5748] DEAD: ... RFCOMM_DLC_DETACH branch at rfcomm_upper.c:293 is UNREACHABLE'; no crash"
  },
  "kernel_refs": [
    "sys/netbt/rfcomm_upper.c:289-296",
    "sys/netbt/rfcomm_upper.c:249-253",
    "sys/netbt/rfcomm_dlc.c:164",
    "sys/netbt/rfcomm_dlc.c:201-204",
    "sys/kern/kern_timeout.c:869",
    "sys/kern/kern_timeout.c:888-921"
  ],
  "artifacts": [
    "harness5748.c", "l2cap_stub.c", "Makefile", "build.sh", "run.sh",
    "build.log", "fix_build.log", "setup.log", "run.log", "fix_run.log",
    "env.txt", "fix.diff", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}