PATCHED
	KKASSERT(m != NULL);

	DPRINTFN(5, "CID #%d sending packet (%d bytes)\n",
		chan->lc_lcid, m->m_pkthdr.len);

	err = hci_acl_send(m, chan->lc_link, chan);
	if (err == 0)
		chan->lc_pending++;
	return err;
== env ==
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
== loading module ==
10    1 0xffffffff82600000     6000 l2pw_harness.ko (/root/l2pw/l2pw_harness.ko)
		328 l2pw_harness
== rig facts ==
hw.l2pw_setup: 0 -> 0
== WEDGE ROUND (the defect) ==
hw.l2pw_go: 0 -> 0
== CONTROL ROUND (healthy accounting) ==
hw.l2pw_ctl: 0 -> 0
== verdicts ==
wedge_proven = 0
ctl_ok       = 1
== unloading ==
hw.l2pw_state: 0 -> 0
== console output (round prints go to dmesg) ==
l2pw: WEDGE ROUND PROVEN (assertion failures: 0)
l2pw: == CONTROL ROUND: OPEN channel, link OPEN ==
l2pw: C1 send ret=0 lc_pending=1 link_pdu=queued frags_out=1
l2pw: C1 PASS: one owned PDU exists; the pending count is backed by a real PDU
l2pw: C2 l2cap_disconnect(linger) ret=0 state=5 (OPEN=5) reqs_empty=1
l2pw: C2 PASS: waiting for queue flush (by design)
l2pw: C3 hci_acl_complete: lc_pending=0 state=6 (WAIT_DISCONNECT=6) reqs=1 complete_cb=1
l2pw: C3 PASS: 1->0 round-trip works; SHUTDOWN flush fired the disconnect request -- exactly what the wedged channel can NEVER do
l2pw: C4 unwind: clean (no panic)
l2pw: CONTROL ROUND OK (assertion failures: 0)
l2pw: wedge_proven=1 ctl_ok=1 disconnected_cb=2 complete_cb=1 frags_out=2
l2pw: unloaded (wedge_proven=1 ctl_ok=1)
l2pw: l2cap pending-wedge rig loaded (production l2cap_*.c + hci_link.c compiled in)
l2pw: rig facts:
l2pw:   sizeof(l2cap_channel)=176 offsetof(lc_pending)=106 offsetof(lc_txq)=112
l2pw:   sizeof(hci_link)=168 sizeof(l2cap_pdu)=64 hz=100
l2pw:   ENETDOWN=50 L2CAP_OPEN=5 L2CAP_WAIT_DISCONNECT=6
l2pw: == WEDGE ROUND: OPEN channel, link HCI_LINK_CLOSED ==
l2pw: W1 send#1 ret=50 (ENETDOWN=50) lc_pending=0 link_txq_empty=1 lc_txq_len=0
l2pw: W1 FAIL (unexpected)
l2pw: W2 FAIL: send#2 ret=50
l2pw: W2 64 more sends: ret==0 all, lc_txq_len=0 (blackholed) lc_pending=0
l2pw: W2 FAIL
l2pw: W3 l2cap_disconnect(linger) ret=50 state=0 (OPEN=5) reqs_empty=1 SHUTDOWN=1
l2pw: W3 FAIL (unexpected)
l2pw: W4 l2cap_start ret=0 lc_txq_len=0 lc_pending=0 state=0
l2pw: W4 FAIL (unexpected)
l2pw: W5 forced detach: chan freed=yes lc_txq drained=yes disconnected_cb=1 (no panic)
l2pw: WEDGE ROUND NOT proven (assertion failures: 5)
l2pw: == CONTROL ROUND: OPEN channel, link OPEN ==
l2pw: C1 send ret=0 lc_pending=1 link_pdu=queued frags_out=1
l2pw: C1 PASS: one owned PDU exists; the pending count is backed by a real PDU
l2pw: C2 l2cap_disconnect(linger) ret=0 state=5 (OPEN=5) reqs_empty=1
l2pw: C2 PASS: waiting for queue flush (by design)
l2pw: C3 hci_acl_complete: lc_pending=0 state=6 (WAIT_DISCONNECT=6) reqs=1 complete_cb=1
l2pw: C3 PASS: 1->0 round-trip works; SHUTDOWN flush fired the disconnect request -- exactly what the wedged channel can NEVER do
l2pw: C4 unwind: clean (no panic)
l2pw: CONTROL ROUND OK (assertion failures: 0)
l2pw: wedge_proven=0 ctl_ok=1 disconnected_cb=2 complete_cb=1 frags_out=2
l2pw: unloaded (wedge_proven=0 ctl_ok=1)
RUN COMPLETE