The RFCOMM multiplexer control-channel handler in `subsys/bluetooth/host/classic/rfcomm.c` contains an integer underflow when computing the echo length for a `BT RFCOMM TEST` command. A malformed UIH frame on DLCI 0 can cause `buf->len` to be 0, resulting in `buf->len - 1` underflowing to 255. This value is passed to the `rfcomm send test()` function, which then copies 255 bytes from a receive buffer that contains no valid data. This process leads to an out-of-bounds read of adjacent stack or pool memory and an out-of-bounds write that overruns the transmit buffer by approximately eight bytes, potentially crashing the Bluetooth host.
The issue can be triggered by an unpaired BR/EDR device within radio range of a target with `CONFIG BT RFCOMM` enabled (such as SPP, HFP, HSP, or GOEP profiles). The vulnerability is specifically exploitable in builds where `CONFIG BT GOEP` is enabled, as it increases the receive MTU beyond the transmit MTU.