AIKIDO-2026-583725

TL;DR

The Realtek BEE Bluetooth HCI driver send callback routes all error paths through a shared cleanup label that unrefs the transmit buffer, violating the contract that the buffer is consumed only on success. When send returns an error the host transmit path unrefs the same buffer again, freeing it twice and corrupting the shared net_buf pool, and one error branch also reads the buffer length after it was freed. Heavy host transmit activity that drives allocation or controller send failures reaches these paths and most likely crashes the device with potential further memory corruption. The fix returns early from error paths without unreffing and unrefs only on success.