[BUG] rtl_bt: RTL8852B BT USB FW 0x127C_FD78 stops delivering BLE keyboard input, 0x42D3_4E04 works

[BUG] rtl_bt: RTL8852B BT USB FW 0x127C_FD78 stops delivering BLE keyboard input, 0x42D3_4E04 works

[Athos Andrade]

Hi,

Since linux-firmware commit 4ca3317e ("rtl_bt: Update RTL8852B BT USB
FW to 0x127C_FD78"), a BLE keyboard connected to the RTL8852BU
Bluetooth controller of my laptop stops delivering key presses every
1 to 4 minutes. Going back to the previous firmware only
(0x42D3_4E04, commit 8bcc91d1) fixes it. I did an A/B test and the
result is repeatable.

Hardware and software
---------------------
- Laptop: Lenovo ThinkPad E14 Gen 4 (21E4001GBO), Intel i5-1235U
- Controller: Realtek RTL8852BE combo card, Bluetooth on USB 0bda:4853
  (ROM: hci_ver=0b hci_rev=000b lmp_subver=8852)
- Firmware: rtl_bt/rtl8852bu_fw.bin
    bad:  0x127cfd78
    good: 0x42d34e04
  rtl8852bu_config.bin is the same in both cases
- Kernel: 7.2.8 (Arch-based distro kernel, linux-omarchy 7.2.8-9)
- linux-firmware-realtek 20260916 (Arch package)
- BlueZ 5.87
- Peripheral: Lofree Flow2-68 keyboard, BLE HID over GATT (HOGP)
- Other LE devices on the same controller: Logitech MX Master 3S,
  Logitech MX Ergo S

Symptom
-------
The keyboard stays connected but stops sending input. In btmon:

- The last ATT Handle Value Notification from the keyboard is a
  key-down report with no matching key-up report.
- After that, no more ACL data arrives from the keyboard handle.
- There is no Disconnect Complete event and no supervision timeout.
- Other LE connections on the same controller (the mouse) keep
  delivering data during the freeze.
- The keyboard does not advertise during the freeze.

The only way to recover is to reconnect the keyboard from the
keyboard side (Disconnect Complete, reason 0x13). The kernel logs
"Bluetooth: hci0: ACL packet for unknown connection handle" at each
reconnect.

The same keyboard works without problems with macOS, with Windows on
a different machine, and with a phone.

Connection parameters
---------------------
The keyboard sends an L2CAP Connection Parameter Update Request right
after connecting, and the host accepts it:

  interval 7.5 ms, peripheral latency 44, supervision timeout 1500 ms

Ruled out (all with 0x127C_FD78)
--------------------------------
- btusb autosuspend (power/control=on): still freezes
- reload of btusb (new firmware download): freezes after ~1 min
- Wi-Fi radio off (rfkill block wlan, wired network): freezes
  after ~4 min
- Num Lock LED off (no LED output report): still freezes
- new pairing on a different keyboard channel: still freezes

A/B test
--------
1. 0x127C_FD78 (package default): 3 freezes in 6 minutes.
2. 0x42D3_4E04 copied to /lib/firmware/updates/rtl_bt/, btusb
   reloaded: no freeze during normal use.
3. Override removed (back to 0x127C_FD78), btusb reloaded: freeze
   after about 1 minute.
4. Override restored (0x42D3_4E04): no freeze again.

I can capture btmon logs (btsnoop) of a freeze and test new firmware
builds if that helps.

Thanks,
Athos Andrade

RE: [BUG] rtl_bt: RTL8852B BT USB FW 0x127C_FD78 stops delivering BLE keyboard input, 0x42D3_4E04 works

[Hilda Wu]

Hi Athos,

Thank you for the detailed information.
Could you please share the btmon log? 
(It would be appreciated if you could also provide the timestamp when the freeze occurred.)
Also, if only one Lofree Flow2-68 keyboard connection is kept, does the issue still occur?

Thank you again.
Regards,
Hilda

-----Original Message-----
From: Athos Andrade <athosandrade04@gmail.com> 
Sent: Tuesday, October 27, 2026 3:55 AM
To: linux-bluetooth@vger.kernel.org
Cc: linux-firmware@kernel.org; Hilda Wu <hildawu@realtek.com>
Subject: [BUG] rtl_bt: RTL8852B BT USB FW 0x127C_FD78 stops delivering BLE keyboard input, 0x42D3_4E04 works


External mail : This email originated from outside the organization. Do not reply, click links, or open attachments unless you recognize the sender and know the content is safe.



Hi,

Since linux-firmware commit 4ca3317e ("rtl_bt: Update RTL8852B BT USB FW to 0x127C_FD78"), a BLE keyboard connected to the RTL8852BU Bluetooth controller of my laptop stops delivering key presses every
1 to 4 minutes. Going back to the previous firmware only (0x42D3_4E04, commit 8bcc91d1) fixes it. I did an A/B test and the result is repeatable.

Hardware and software
---------------------
- Laptop: Lenovo ThinkPad E14 Gen 4 (21E4001GBO), Intel i5-1235U
- Controller: Realtek RTL8852BE combo card, Bluetooth on USB 0bda:4853
  (ROM: hci_ver=0b hci_rev=000b lmp_subver=8852)
- Firmware: rtl_bt/rtl8852bu_fw.bin
    bad:  0x127cfd78
    good: 0x42d34e04
  rtl8852bu_config.bin is the same in both cases
- Kernel: 7.2.8 (Arch-based distro kernel, linux-omarchy 7.2.8-9)
- linux-firmware-realtek 20260916 (Arch package)
- BlueZ 5.87
- Peripheral: Lofree Flow2-68 keyboard, BLE HID over GATT (HOGP)
- Other LE devices on the same controller: Logitech MX Master 3S,
  Logitech MX Ergo S

Symptom
-------
The keyboard stays connected but stops sending input. In btmon:

- The last ATT Handle Value Notification from the keyboard is a
  key-down report with no matching key-up report.
- After that, no more ACL data arrives from the keyboard handle.
- There is no Disconnect Complete event and no supervision timeout.
- Other LE connections on the same controller (the mouse) keep
  delivering data during the freeze.
- The keyboard does not advertise during the freeze.

The only way to recover is to reconnect the keyboard from the keyboard side (Disconnect Complete, reason 0x13). The kernel logs
"Bluetooth: hci0: ACL packet for unknown connection handle" at each reconnect.

The same keyboard works without problems with macOS, with Windows on a different machine, and with a phone.

Connection parameters
---------------------
The keyboard sends an L2CAP Connection Parameter Update Request right after connecting, and the host accepts it:

  interval 7.5 ms, peripheral latency 44, supervision timeout 1500 ms

Ruled out (all with 0x127C_FD78)
--------------------------------
- btusb autosuspend (power/control=on): still freezes
- reload of btusb (new firmware download): freezes after ~1 min
- Wi-Fi radio off (rfkill block wlan, wired network): freezes
  after ~4 min
- Num Lock LED off (no LED output report): still freezes
- new pairing on a different keyboard channel: still freezes

A/B test
--------
1. 0x127C_FD78 (package default): 3 freezes in 6 minutes.
2. 0x42D3_4E04 copied to /lib/firmware/updates/rtl_bt/, btusb
   reloaded: no freeze during normal use.
3. Override removed (back to 0x127C_FD78), btusb reloaded: freeze
   after about 1 minute.
4. Override restored (0x42D3_4E04): no freeze again.

I can capture btmon logs (btsnoop) of a freeze and test new firmware builds if that helps.

Thanks,
Athos Andrade