What steps will reproduce the problem? 1. Call gap_dedicated_bonding for a device. 2. On a GAP_DEDICATED_BONDING_COMPLETED event, call sdp_query_rfcomm_channel_and_name_for_uuid. 3. An SDP_QUERY_COMPLETE is immediately received, with status 0x81 (SDP_QUERY_INCOMPLETE).

What version of the product are you using? On what operating system? Present in the latest r2654.

Relevant part of the log: [2014-06-18 14:43:25.598] LOG -- hci_emit_dedicated_bonding_result 0 [2014-06-18 14:43:25.598] EVT <= E1 07 00 71 1F D4 DB C6 BC [2014-06-18 14:43:25.601] CMD => 06 04 03 02 00 13 [2014-06-18 14:43:25.602] LOG -- L2CAP_CREATE_CHANNEL_MTU addr BC:C6:DB:D4:1F:71 psm 0x1 mtu 668 [2014-06-18 14:43:25.603] LOG -- l2cap_create_channel_internal, hci connection already exists [2014-06-18 14:43:25.603] LOG -- l2cap_handle_connection_complete expected state [2014-06-18 14:43:25.603] LOG -- l2cap received remote supported features, sec_level_0_allowed for psm 1 = 1 [2014-06-18 14:43:25.604] CMD => 34 F4 08 71 1F D4 DB C6 BC 2F 11 [2014-06-18 14:43:25.606] EVT <= 0F 04 00 01 06 04 [2014-06-18 14:43:25.607] ACL => 02 20 0C 00 08 00 01 00 02 01 04 00 01 00 40 00 [2014-06-18 14:43:25.609] LOG -- l2cap_start_rtx for local cid 0x40 [2014-06-18 14:43:25.609] LOG -- l2cap_stop_rtx for local cid 0x40 [2014-06-18 14:43:25.632] EVT <= 13 05 01 02 00 01 00 [2014-06-18 14:43:25.711] EVT <= 05 04 00 02 00 16 [2014-06-18 14:43:25.712] LOG -- Connection closed: handle 2, BC:C6:DB:D4:1F:71

I believe the problem is caused by the sdp query trying to reuse the dedicated bonding's hci connection. When the dedicated bonding is done, an hci_disconnect is sent, but the connection stays in the connections list. When the sdp client tries to create an l2cap channel, l2cap_create_channel_internal finds the existing hci connection and tries to use it, but the disconnection will complete in a moment. I think there a few things to consider here: - Dedicated bonding's hci connection shouldn't be reused, since it will be disconnected when the bonding completes. - I think it will be a good idea for hci_connection_for_bd_addr_and_type to check the hci connection's state and make sure its usable. But it means that whenever someone sends a hci_disconnect command, the hci connection's state must be updated. - Another option is to a add a reference count to the hci connection.

Just to make sure this what was causing the problem, I've commented the line which sends the disconnection when the bonding completes (in hci_run): hci_send_cmd(&hci_disconnect, connection->con_handle, 0x13); // authentication done

And the SDP query worked properly.

Event "dedicated bonding complete" is now sent after the HCI connection is closed, SVN r2745