### run.sh ssh stdout ###
== loading module ==
 5    1 0xffffffff82604000     5000 rfcomm_up5748.ko (/root/rfup/DF-5748/rfcomm_up5748.ko)
		326 rfcomm_up5748
== firing scenario (hw.df5748_fire=1) ==
EXPECT: DEAD-guard observation, clean completion (~25 s incl. sleep)
hw.df5748_fire: 0 -> 0
== done (module left loaded; guest reset cleans up) ==

### dmesg (kernel console) — baseline run, verbatim production code ###
=== DF-5748 harness: dead callout_active()/RFCOMM_DLC_DETACH guard ===
[harness] == L2CAP connected ==
[l2cap-stub] send: 4 bytes (first octet 0x3)
[harness] <- UA(0) [session up] (4 bytes): 03 73 01 d7
[l2cap-stub] send: 11 bytes (first octet 0x3)
[l2cap-stub] send: 11 bytes (first octet 0x3)
[harness] <- UIH(0) PN response (valid mtu) (14 bytes): 03 ef 15 81 11 06 e0 00 00 7f 00 00 00 70
[l2cap-stub] send: 4 bytes (first octet 0x1b)
[harness] <- UA(dlci) [dlc up] (4 bytes): 1b 73 01 18
[l2cap-stub] send: 6 bytes (first octet 0x3)
[upper] connected
[harness] <- UIH(0) MSC response (8 bytes): 03 ef 09 e1 05 1b 8d 70
[harness] <- UIH(0) PN response (valid mtu) (14 bytes): 03 ef 15 81 11 08 e0 00 00 7f 00 00 00 70
[l2cap-stub] send: 4 bytes (first octet 0x23)
[harness] <- UA(dlci) [dlc up] (4 bytes): 23 73 01 02
[l2cap-stub] send: 6 bytes (first octet 0x3)
[upper] connected
[harness] <- UIH(0) MSC response (8 bytes): 03 ef 09 e1 05 23 8d 70
[DF-5748] dlc A state=6 (6=OPEN), dlc B state=6 (6=OPEN)
[l2cap-stub] send: 4 bytes (first octet 0x1b)
[DF-5748] disconnect(A) -> 0; state=7 (7=WAIT_DISCONNECT)
[l2cap-stub] send: 4 bytes (first octet 0x23)
[DF-5748] disconnect(B) -> 0; state=7
[DF-5748] A timer: pending=1 active=1   (ARMED by rfcomm_disconnect:252)
[upper] disconnected (0)
[DF-5748] A after rfcomm_dlc_close(): pending=0 active=0
[DF-5748] DEAD: callout_active() == 0 after rfcomm_dlc_close(); the RFCOMM_DLC_DETACH branch at rfcomm_upper.c:293 is UNREACHABLE
[upper] disconnected (0)
[DF-5748] rfcomm_detach(B) returned; B freed via immediate kfree (DETACH flag never taken)
[DF-5748] session left empty -> 20 s expiry callout will rfcomm_session_free() it; sleep to let it fire cleanly
=== DF-5748 harness done (no crash) ===