{
  "finding_id": "DF-5749",
  "file": "sys/netbt/l2cap_upper.c",
  "title": "l2cap_detach()/l2cap_close() (netisr port) race softclock l2cap_rtx() with no synchronization: double channel/request teardown -> kernel page fault (supervisor WRITE), zone double-free, hard freeze",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh (inside guest, /root/l2uh)",
    "run": "kldload ./l2uh_harness.ko; sysctl hw.l2uh_once=1; sysctl hw.l2uh_race3=2000",
    "expected": "control round clean; race3 panics the kernel (Fatal trap 12 @0x70 in l2cap_request_free, or 'zone: freeing free entry' from l2cap_rtx)"
  },
  "kernel_refs": [
    "sys/netbt/l2cap_upper.c:259",
    "sys/netbt/l2cap_misc.c:184",
    "sys/netbt/l2cap_lower.c:69",
    "sys/netbt/l2cap_lower.c:97",
    "sys/kern/kern_timeout.c:1091"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "harness.c", "stub.c", "l2uh.h", "Makefile",
    "build.sh", "run.sh", "fixbuild.sh", "fix.diff",
    "build.log", "setup.log", "run.log", "panic.txt",
    "console_panic.txt", "console_baseline_final.txt",
    "fix_build.log", "fix_run.log", "env.txt",
    "manifest.json", "verdict.json"
  ]
}