[RFC PATCH v6 2/2] Bluetooth: L2CAP: tolerate zero-ident LE credit indications

[Kyle Pepper <cochcoder@proton.me>]

Cochlear Nucleus N8 captures contain LE credit indications with
identifier zero. The specification forbids zero identifiers, so the
current parser discards these grants and leaves the channel without
usable transmit credits.

Accept nonzero grants only for connected legacy LE CoC channels. Keep
ECRED and all other commands excluded because the observed
interoperability issue concerns legacy LE CoC. Apply normal credit
overflow and pending-security handling, including the shared transmit
guard from the preceding patch.

Let the credit handler validate the exact payload size after the
signaling parser validates framing.

Assisted-by: LLM
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes in v6:
- Rebase on the revised security patch; zero-ID source edits are unchanged.

AI review of v5:
https://sashiko.dev/#/patchset/20261106045515.853897-1-cochcoder%40proton.me

Sashiko reported no findings for v5 patch 2. The legacy LE CoC exception
still needs maintainer policy review. Native L2CAP and hardware behavior
remain unverified.

AI assistance: Codex prepared the revision and local tests. Attribution is
retained.

 net/bluetooth/l2cap_core.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 24360d8e1..8d322d609 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5401,6 +5401,10 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
 	     chan->mode != L2CAP_MODE_EXT_FLOWCTL))
 		goto unlock;
 
+	/* Tolerate identifier-zero credits only for a live LE CoC. */
+	if (!cmd->ident && (!credits || chan->mode != L2CAP_MODE_LE_FLOWCTL))
+		goto unlock;
+
 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
 	if (credits > max_credits) {
 		BT_ERR("LE credits overflow");
@@ -6010,11 +6014,20 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
 
 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
 
-	if (len != skb->len || !cmd->ident) {
+	if (len != skb->len) {
 		BT_DBG("corrupted command");
 		goto drop;
 	}
 
+	if (!cmd->ident) {
+		if (cmd->code != L2CAP_LE_CREDITS)
+			goto drop;
+
+		/* Credits have no response or identifier-matched transaction. */
+		l2cap_le_credits(conn, cmd, len, skb->data);
+		goto drop;
+	}
+
 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
 	if (err) {
 		struct l2cap_cmd_rej_unk rej;