I'm having some trouble with the bluez implementation as distributed
with fedora.  I thought for a long time that this was a bug on the
device (Ericsson P900 / Symbian 7.0) side of the connection, but it's
now looking like a kernel issue on the linux box.

The app on the other side is a simple RFCOMM echoer.  It reads a byte
at a time and writes it back out to the socket.  I'm connecting to it
with a "cat /dev/rfcomm1", while I do a "echo a > /dev/rfcomm1" from
another shell.  What comes back is an unending spew of bytes, mostly
(but oddly not entirely) derived from the "a\r\n" that went out the
terminal initially.

FWIW, I see almost identical behavior when connecting to the "modem"
device on the phone.  The AT command work (in the sense that I can see
the desired output appear on the socket), but come back as part of an
infinite garbage stream.

Attached is the result of an hcidump -tx of such a session.  Note that
the local machine never stops sending data, despite the fact that I
can verify with strace that only 3 bytes of data are ever written to
the rfcomm device.

Can anyone shed some light on this?

Andy