{
  "finding_id": "DF-5750",
  "file": "sys/netbt/l2cap_upper.c",
  "title": "l2cap_bind() missing channel-state check: re-bind of a live listener mutates its advertised PSM in place (DF-5747 parity)",
  "verdict": "reproduced",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O -o bind_state bind_state.c",
    "run": "kldload netbt (root, once); ./bind_state as unprivileged user",
    "expected": "RE-bind of the LISTENING socket returns 0 (should be EINVAL)"
  },
  "kernel_refs": [
    "sys/netbt/l2cap_upper.c:106",
    "sys/netbt/l2cap_upper.c:302",
    "sys/netbt/l2cap_signal.c:266"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "bind_state.c",
    "run.sh",
    "run.log",
    "manifest.json",
    "verdict.json"
  ]
}