--- /home/maxx/dfbsd/dfbsd/sys/netbt/rfcomm_session.c	2026-06-29 12:51:19.000000000 +0000
+++ rs.c	2026-10-11 12:26:52.948871124 +0000
@@ -1321,6 +1321,20 @@
 	dlc = rfcomm_dlc_lookup(rs, pn.dlci);
 	if (cr) {	/* Command */
 		/*
+		 * Validate the direction bit: a PN command must use a DLCI
+		 * in the caller's direction (the same check
+		 * rfcomm_session_recv_sabm() makes).  Without it the peer
+		 * can fabricate DLCs in our own DLCI space and permanently
+		 * block local outgoing connections (EBUSY in
+		 * rfcomm_connect()).
+		 */
+		if ((IS_INITIATOR(rs) && !RFCOMM_DIRECTION(pn.dlci))
+		    || (!IS_INITIATOR(rs) && RFCOMM_DIRECTION(pn.dlci))) {
+			rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM, pn.dlci);
+			return;
+		}
+
+		/*
 		 * If there is no DLC present, this is a new
 		 * connection so attempt to make one
 		 */