DF-3479 — ng_btsocket_l2cap_attach() misses the "implied pcb ref" (soreference): KKASSERT panic in sonewconn on every inbound L2CAP connection; socket refcount runs one low on non-INVARIANTS kernels

What

DragonFly's sonewconn_faddr() (sys/kern/uipc_socket2.c) attaches a new pcb to the freshly allocated child socket by direct-calling the protocol's pru_attach and then asserts the socket reference accounting:

    so_pru_attach_direct(so, 0, &ai);
    KKASSERT(((so->so_proto->pr_flags & PR_ASYNC_RCVD) == 0 &&
        so->so_refs == 2) || ...);       /* uipc_socket2.c:398-404 */
                       /* "attach + our base ref" */

PCB-based protocols take that second reference when they attach (e.g. in_pcballoc() calls soreference(so), sys/netinet/in_pcb.c:295). ng_btsocket_l2cap_attach() (sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1912-2030) links so->so_pcb/pcb->so but never calls soreference(), so on every inbound connection (ng_btsocket_l2cap_process_l2ca_con_ind() :593 -> sonewconn(pcb->so, 0)) the assertion fires on INVARIANTS kernels:

panic: assertion "... so->so_refs == 2 ..." failed in sonewconn_faddr
    at /usr/src/sys/kern/uipc_socket2.c:404
sonewconn_faddr() <- ng_btsocket_l2cap_input() <- taskqueue_run() <- ithread_handler()

On non-INVARIANTS (production) kernels the assertion is compiled out and the child socket's refcount simply runs one reference lower than the socket-layer contract — the pcb (still registered in ng_btsocket_l2cap_sockets) can outlive the freed socket (pcb->so dangling), a latent use-after-free whenever an accepted L2CAP socket is closed.

Threat

Remote-triggerable: any Bluetooth peer that opens a connection to a PSM a local socket is listening on (the ordinary "connect to SDP/RFCOMM service" flow) makes the kernel panic (INVARIANTS builds). Locally reproducible with the DF-3480 harness (fake ng_l2cap lower layer, no BT hardware needed): deliver NGM_L2CAP_L2CA_CON_IND for a bound/listening PSM.

Reproduce

Guest with netgraph7 bluetooth stack loaded, btsbx.ko harness (see ../DF-3480) connected to the btsock_l2c node; a listener bound to PSM 0x1234:

sysctl -w debug.btsbx_cmd=1   # setup hooks + hook_info
sysctl -w debug.btsbx_cmd=2   # con_ind -> panic (baseline)

Baseline panic.txt captured. With fix.diff applied (adds the missing soreference(so) — plus #include <sys/socketvar2.h>), the same command completes: the harness drove the full CON/CFG handshake to OPEN, accept() returned a child socket, and 16M+ data packets were transferred through it.

Fix (validated)

--- a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c
+++ b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c
@@ -1960,6 +1960,7 @@
    so->so_pcb = (caddr_t) pcb;
    pcb->so = so;
    pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
+   soreference(so);    /* implied pcb ref (sonewconn expects so_refs==2) */

(note: ng_btsocket_l2cap_raw / rfcomm / hci_raw attach paths should be audited for the same omission — separate files.)