== env ==
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC
== loading module ==
 9    1 0xffffffff82600000     6000 l2pw_harness.ko (/root/l2pw/l2pw_harness.ko)
		327 l2pw_harness
== rig facts ==
hw.l2pw_setup: 0 -> 0
== WEDGE ROUND (the defect) ==
hw.l2pw_go: 0 -> 0
== CONTROL ROUND (healthy accounting) ==
hw.l2pw_ctl: 0 -> 0
== verdicts ==
wedge_proven = 1
ctl_ok       = 1
== unloading ==
hw.l2pw_state: 0 -> 0
== console output (round prints go to dmesg) ==
l2pw: W5 forced detach: chan freed=yes lc_txq drained=yes disconnected_cb=1 (no panic)
l2pw: WEDGE ROUND NOT proven (assertion failures: 1)
l2pw: == CONTROL ROUND: OPEN channel, link OPEN ==
l2pw: C1 send ret=0 lc_pending=1 link_pdu=queued frags_out=1
l2pw: C1 PASS: one owned PDU exists; the pending count is backed by a real PDU
l2pw: C2 l2cap_disconnect(linger) ret=0 state=5 (OPEN=5) reqs_empty=1
l2pw: C2 PASS: waiting for queue flush (by design)
l2pw: C3 hci_acl_complete: lc_pending=0 state=6 (WAIT_DISCONNECT=6) reqs=1 complete_cb=1
l2pw: C3 PASS: 1->0 round-trip works; SHUTDOWN flush fired the disconnect request -- exactly what the wedged channel can NEVER do
l2pw: C4 unwind: clean (no panic)
l2pw: CONTROL ROUND OK (assertion failures: 0)
l2pw: wedge_proven=0 ctl_ok=1 disconnected_cb=2 complete_cb=1 frags_out=2
l2pw: unloaded (wedge_proven=0 ctl_ok=1)
l2pw: l2cap pending-wedge rig loaded (production l2cap_*.c + hci_link.c compiled in)
l2pw: rig facts:
l2pw:   sizeof(l2cap_channel)=176 offsetof(lc_pending)=106 offsetof(lc_txq)=112
l2pw:   sizeof(hci_link)=168 sizeof(l2cap_pdu)=64 hz=100
l2pw:   ENETDOWN=50 L2CAP_OPEN=5 L2CAP_WAIT_DISCONNECT=6
l2pw: == WEDGE ROUND: OPEN channel, link HCI_LINK_CLOSED ==
l2pw: W1 send#1 ret=50 (ENETDOWN=50) lc_pending=1 link_txq_empty=1 lc_txq_len=0
l2pw: W1 PASS: pending==1 but NO pdu exists on the link that could ever decrement it (unbalanced l2cap_lower.c:203)
l2pw: W2 64 more sends: ret==0 all, lc_txq_len=64 (blackholed) lc_pending=1
l2pw: W2 PASS: TX blackhole armed (64 SDUs accepted, 0 can ever leave)
l2pw: W3 l2cap_disconnect(linger) ret=0 state=5 (OPEN=5) reqs_empty=1 SHUTDOWN=1
l2pw: W3 PASS: graceful disconnect permanently disabled (l2cap_upper.c:244 gate never true)
l2pw: W4 l2cap_start ret=50 lc_txq_len=63 lc_pending=2 state=5
l2pw: W4 PASS: retry inflated the phantom count to 2 and burned another blackholed SDU -- the leak compounds on every l2cap_start caller (l2cap_send/hci_acl_complete/hci_acl_start)
l2pw: W5 forced detach: chan freed=yes lc_txq drained=yes disconnected_cb=1 (no panic)
l2pw: WEDGE ROUND PROVEN (assertion failures: 0)
l2pw: == CONTROL ROUND: OPEN channel, link OPEN ==
l2pw: C1 send ret=0 lc_pending=1 link_pdu=queued frags_out=1
l2pw: C1 PASS: one owned PDU exists; the pending count is backed by a real PDU
l2pw: C2 l2cap_disconnect(linger) ret=0 state=5 (OPEN=5) reqs_empty=1
l2pw: C2 PASS: waiting for queue flush (by design)
l2pw: C3 hci_acl_complete: lc_pending=0 state=6 (WAIT_DISCONNECT=6) reqs=1 complete_cb=1
l2pw: C3 PASS: 1->0 round-trip works; SHUTDOWN flush fired the disconnect request -- exactly what the wedged channel can NEVER do
l2pw: C4 unwind: clean (no panic)
l2pw: CONTROL ROUND OK (assertion failures: 0)
l2pw: wedge_proven=1 ctl_ok=1 disconnected_cb=2 complete_cb=1 frags_out=2
l2pw: unloaded (wedge_proven=1 ctl_ok=1)
RUN COMPLETE