The function hci_number_free_acl_slots_for_handle() checks if classic slots shall be used on dual mode controllers:

if (hci_stack->le_acl_packets_total_num){ // if we have LE slots, they are used free_slots_le = hci_stack->le_acl_packets_total_num - num_packets_sent_le; else { // otherwise, classic slots are used for LE, too free_slots_classic -= num_packets_sent_le;

But then it returns the wrong value if the address type is BD_ADDR_TYPE_LE_RANDOM or BD_ADDR_TYPE_LE_PUBLIC:

switch (address_type){
    case BD_ADDR_TYPE_UNKNOWN:
        log_error("hci_number_free_acl_slots: handle 0x%04x not in connection list", con_handle);
        return 0;

    case BD_ADDR_TYPE_CLASSIC:
        return free_slots_classic;

    default:
            return free_slots_le;
}

free_slots_le is 0, because classic slots are used.

I have modified the code to be like this:

switch (address_type){
    case BD_ADDR_TYPE_UNKNOWN:
        log_error("hci_number_free_acl_slots: handle 0x%04x not in connection list", con_handle);
        return 0;

    case BD_ADDR_TYPE_CLASSIC:
        return free_slots_classic;

    default:
        if (hci_stack->le_acl_packets_total_num)
            return free_slots_le;
        else
            return free_slots_classic;
}

This issue was closed by revision r2753.

Thanks for spotting this. I was close, but after finally calculated the number of free classic and le slots, forgot this last detail.