I've encountered a problem were a timer struct was being accessed by the run loop after it was freed. I believe it was caused by an l2cap channel being freed while the timer was active. To fix it, I've added a call to l2cap_stop_rtx before every call to btstack_memory_l2cap_channel_free and I believe it fixed it. I believe it's a safe thing to do anyway.

Fixed in r2706. I'll also replace the tricky code to iterate over a list while removing elements with the iterator that I created recently.