{
  "finding_id": "DF-5781",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Analysis-only (Low severity; PoC skipped per contract). hci_route_lookup walks hci_unit_list and unit->hci_links unlocked (hci_misc.c:65-100) against hci_attach/hci_detachs crit_enter-only list mutations (hci_unit.c:113-127) and hci_disables teardown (hci_unit.c:238-248, privileged SIOCSBTFLAGS hci_ioctl.c:223-231). Detach/disable racing an unprivileged connect gives UAF reads and a 6-byte freed-heap read into the socket laddr (hci_misc.c:105, getsockname-readable). Root/physical precondition on one side -> Low, unverified on the guest (its memo-list sibling DF-5780 was reproduced).",
  "exploit_chain": "",
  "evidence": "source citations in README.md (this directory)",
  "kernel_refs": [
    "sys/netbt/hci_misc.c:65-107",
    "sys/netbt/hci_unit.c:113-127",
    "sys/netbt/hci_unit.c:238-248",
    "sys/netbt/hci_ioctl.c:223-242"
  ],
  "poc_changes": "n/a (not built)",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity -> Phase V skipped per contract; code defect certain from source analysis, exploitability conditional on privileged/physical other side",
  "recommended_fix": "global netbt unit-list lock (or per-unit refcount) held across hci_route_lookup walks and hci_attach/hci_detach/hci_disable",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "",
  "fix_evidence": ""
}