# attempt 1 (rig bug, NOT a kernel finding): chain head was a pkthdr mbuf
# with m_len=MLEN (> MHLEN data room). m_copym's partial copy tripped
#   panic: overflowed mbuf 0xfffff80119bafa00
#   m_free() at m_free+0x351
#   m_copym() at m_copym+0x1a5
#   rfcomm_ssend() at rfcomm_ssend+0x48
# (KASSERT(M_TRAILINGSPACE(m) >= 0) in m_free, sys/kern/uipc_mbuf.c:1317).
# No in-kernel caller builds such a chain; fixed the rig (MHLEN everywhere)
# and re-ran. Guest was vm.sh-reset before the valid runs.