{
  "finding_id": "DF-5780",
  "title": "sys/netbt/hci_misc.c: unsynchronized hci_memos lifecycle -- concurrent hci_memo_find walkers double-free hci_memo (unprivileged L2CAP/SCO connect vs netisr vs softclock)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cd /root/hcir && sh build.sh   (KLD: verbatim netbt + harness2.c; cc -pthread race.c)",
    "run": "sh run3.sh 6 30    (burst mode; unprivileged racer: su -m maxx -c /tmp/race)",
    "expected": "kernel panic within ~5-35s: 'assertion \"kuhp < 0\" failed' (double free) or chunk_mark_free zone assert in kern_slaballoc.c, hci_memo_find expiry print on the panic line; with fix.diff applied: no panic, watchdog dup=0 stuck=0"
  },
  "kernel_refs": [
    "sys/netbt/hci_misc.c:113-138",
    "sys/netbt/hci_misc.c:145-173",
    "sys/netbt/hci_misc.c:175-181",
    "sys/netbt/hci_misc.c:55-107",
    "sys/netbt/l2cap_socket.c:351-367",
    "sys/netbt/l2cap_upper.c:140-172",
    "sys/netbt/hci_event.c:463-472",
    "sys/netbt/hci_event.c:500-508",
    "sys/netbt/hci_link.c:99-104",
    "sys/netbt/hci_link.c:1013-1019",
    "sys/netbt/hci_unit.c:335-352",
    "sys/netbt/hci_unit.c:247-248"
  ],
  "artifacts": [
    "harness2.c", "Makefile", "build.sh", "race.c", "run.sh", "run2.sh", "run3.sh",
    "build.log", "env_setup_md5.txt", "env.txt",
    "panic.txt", "panic_run2.txt", "boot_run2_panic.log",
    "fix.diff", "fix_run.log",
    "VERDICT.md", "verdict.json", "manifest.json", "xfer.sh"
  ]
}