AIKIDO-2026-951644

TL;DR

The Bouffalo Lab on-chip Bluetooth HCI driver send callback routes all error paths through a shared label that unrefs the transmit buffer, breaking the contract that the reference is consumed only on success. When send returns an error the host transmit path unrefs the same buffer again, over-decrementing its reference count and prematurely freeing a parent fragment still queued on the connection, a use-after-free that corrupts the shared net_buf pool. Controller send failures or unsupported packet types reach these paths, producing a Bluetooth-stack crash with possible further memory corruption. The fix returns early from error paths without unreffing and unrefs the buffer only on success.