{
  "finding_id": "DF-5764",
  "file": "sys/netbt/l2cap_lower.c",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "scp pack to guest /root/l2pw; cd /root/l2pw && ./build.sh   (copies VERBATIM /usr/src/sys/netbt/{l2cap_upper,l2cap_lower,l2cap_misc,l2cap_signal,hci_link}.c, md5s in setup.log, builds l2pw_harness.ko)",
    "run": "cd /root/l2pw && ./run.sh   (kldload; sysctl hw.l2pw_setup=1; hw.l2pw_go=1 WEDGE round; hw.l2pw_ctl=1 CONTROL round; dumps console output; kldunload)",
    "expected": "unfixed: hw.l2pw_wedge_proven=1 and hw.l2pw_ctl_ok=1, no panic — W1 failed send leaves lc_pending=1 with no PDU on hl_txq; W2 64 further sends silently blackhole in lc_txq; W3 graceful disconnect permanently disabled (state stays L2CAP_OPEN, hl_reqs empty); W4 retry compounds the phantom count (pending 1->2). With fix.diff applied to /usr/src: wedge_proven flips to 0 (pending==0 after failure; honest ENETDOWN per send; channel reaches CLOSED via disconnect) while ctl_ok stays 1."
  },
  "kernel_refs": [
    "sys/netbt/l2cap_lower.c:195",
    "sys/netbt/l2cap_lower.c:203",
    "sys/netbt/l2cap_lower.c:204",
    "sys/netbt/l2cap_upper.c:398",
    "sys/netbt/l2cap_upper.c:244",
    "sys/netbt/hci_link.c:546",
    "sys/netbt/hci_link.c:730"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "harness.c", "stub.c", "l2uh.h", "Makefile",
    "build.sh", "run.sh", "fix.diff",
    "build.log", "setup.log", "run.log", "fix_run.log", "env.txt",
    "manifest.json", "verdict.json"
  ]
}