[RFC PATCH v5 2/2] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[Kyle Pepper <cochcoder@proton.me>]

Cochlear Nucleus N8 captures contain LE credit indications with
identifier zero. The specification forbids zero identifiers, so the
current parser discards these grants and leaves the channel without
usable transmit credits.

Accept nonzero grants only for connected legacy LE CoC channels. Keep
ECRED and all other commands excluded because the observed
interoperability issue concerns legacy LE CoC. Apply normal credit
overflow and pending-security handling, including the shared transmit
guard from the preceding patch.

Let the credit handler validate the exact payload size after the
signaling parser validates framing.

Assisted-by: LLM

Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes in v5:
- Explain the observed Nucleus N8 behavior and legacy LE CoC restriction.
- Use the credit handler's existing exact payload-size validation.
- Depend on v5's shared security transmit guard.

AI review:
https://sashiko.dev/#/patchset/20261106021723.631339-1-cochcoder%40proton.me

Credit/parser fixtures pass. ECRED remains excluded from the zero-ID exception.
Native L2CAP and hardware behavior remain unverified. The interoperability
exception remains subject to maintainer policy approval.

AI assistance: Codex prepared source revisions, descriptions and local tests
in response to the v4 automated review. Attribution is retained.

 net/bluetooth/l2cap_core.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index ae6659fab..d3b875c47 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5388,6 +5388,10 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
 		goto unlock;
 
+	/* Tolerate identifier-zero credits only for a live LE CoC. */
+	if (!cmd->ident && (!credits || chan->mode != L2CAP_MODE_LE_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
@@ -5997,11 +6001,20 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
 
-	if (len != skb->len || !cmd->ident) {
+	if (len != skb->len) {
 		BT_DBG("corrupted command");
 		goto drop;
 	}
 
+	if (!cmd->ident) {
+		if (cmd->code != L2CAP_LE_CREDITS)
+			goto drop;
+
+		/* Credits have no response or identifier-matched transaction. */
+		l2cap_le_credits(conn, cmd, len, skb->data);
+		goto drop;
+	}
+
 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
 	if (err) {
 		struct l2cap_cmd_rej_unk rej;