CVE-2026-77685

The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BTRFCOMMTEST command as buf-len - 1 and passed it to rfcommsendtest, whose length parameter is a uint8t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf-len == 0 aft...