CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...