Hello, Our fuzzer found a BT spec violation, illegal state transition on L2cap. Specifically, l2cap_chan::state is transitioned from BT_CONFIG to BT_DISCONN by CONFIG_RSP by following trace: l2cap_config_rsp l2cap_core.c:4498 l2cap_send_disconn_req l2cap_core.c:4585 l2cap_state_change l2cap_core.c:1618 According to the spec 5.3 vol.3 part A 6.1.4, CONFIG_RSP cannot cause that transition, i.e., CONFIG -> DISCONN by CONFIG_RSP is illegal. It'd be great if we could discuss. Thanks, Sungwoo.
