# DF-5750 VERDICT

**Reproduced** as the unprivileged user (`maxx`) on
DragonFly 6.5-DEVELOPMENT X86_64_GENERIC with `kldload netbt`
(netbt is KLD-only; loading is privileged, using the sockets is not).

`sys/netbt/l2cap_upper.c:106-112`:

```c
int
l2cap_bind(struct l2cap_channel *chan, struct sockaddr_bt *addr)
{
	memcpy(&chan->lc_laddr, addr, sizeof(struct sockaddr_bt));
	return 0;
}
```

No state check, no PSM validation (the caller `l2cap_sbind`
`sys/netbt/l2cap_socket.c:320-339` only validates `bt_len`/`bt_family`).
`l2cap_listen()` validated the PSM at listen time
(`l2cap_upper.c:309-311`) and inserted the channel into
`l2cap_listen_list` ordered by that PSM (`l2cap_upper.c:327-342`); the
re-bind replaces the PSM in place.  Incoming connection requests match
listeners first-match with the *current* PSM
(`sys/netbt/l2cap_signal.c:266-273`), so a re-bound listener silently
changes which service PSM it answers — and the sorted-insert invariant
documented at `l2cap_upper.c:321-326` no longer describes the list.
Demonstrated output in `run.log`: re-bind of a LISTENING L2CAP socket
returns 0; the socket remains a listener (`listen()` again → EINVAL
because of the `L2CAP_SIGNAL_CID` marker, `l2cap_upper.c:306-307`).
Also demonstrated: two sockets can listen on the same PSM (no
duplicate-listener rejection, first-listener-wins silently).

Not a memory-safety bug on its own (the LIST stays structurally
consistent; only match precedence changes) — severity Info, parity
with DF-5747 (`rfcomm_bind`).  Fix: reject `bind()` unless
`chan->lc_state == L2CAP_CLOSED && chan->lc_lcid == L2CAP_NULL_CID`
(exactly the NetBSD upstream fix shape taken for rfcomm).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)