# DF-5750 — `l2cap_bind()` has no channel-state check (DF-5747 parity)

`sys/netbt/l2cap_upper.c:106-112`: `l2cap_bind()` memcpy's the new local
address into the channel unconditionally.  A channel that is already
**listening** (on `l2cap_listen_list`, inserted sorted by its old PSM at
`l2cap_listen()`, `l2cap_upper.c:302-345`, matched first-match at
`l2cap_signal.c:266-273`) can be re-bound in place to any other PSM —
silently mutating the routing key of a live listener.  Upstream added
the missing state check to the rfcomm sibling (`rfcomm_bind`, cf.
DF-5747); `l2cap_bind()` never got one.

## Reproduce

```sh
# guest, once as root: kldload netbt
cc -O -o bind_state bind_state.c
./bind_state        # as the UNPRIVILEGED user
```

## Expected (vulnerable) — see run.log

```
bind(psm=BNEP)           = 0 (ok)
listen()                 = 0 (ok, channel now on l2cap_listen_list)
RE-bind(psm=HID_CNTL) on the LISTENING socket = 0 (ok)   <-- DF-5750
listen() again           = -1 (Invalid argument)  [still a listener]
bind(same psm on 2nd socket) = 0 (ok (no duplicate-PSM rejection))
listen() on 2nd socket   = 0 (ok)
```

Impact: semantic (listener routing-key mutation + no duplicate-PSM
rejection — on hosts with a Bluetooth controller any local user can
occupy/re-route service PSMs; cf. DF-3477 for the ng_btsocket analog).
No memory-safety consequence demonstrated: the list stays consistent
(first-match semantics only), hence severity Info.