DF-0421
ng_ubt_rcvdata calls panic() on malformed HCI frames from netgraph hook: local DoS
Summary
ng_ubt_rcvdata(:1755-1775) calls panic() on: (1) mbuf<4 bytes(:1755-1757), (2) HCI cmd payload>UBT_CTRL_BUFFER_SIZE(:1762-1765), (3) ACL payload>UBT_BULK_WRITE_BUFFER_SIZE(:1772-1775). panic() halts kernel. Privileged netgraph user or buggy upper-layer node sends single malformed mbuf -> system crash. Should drop packet + return EMSGSIZE.