------------[ cut here ]------------
WARNING: CPU: 1 PID: 6582 at net/bluetooth/hci_conn.c:568 hci_conn_timeout+0xf4/0x1e8 net/bluetooth/hci_conn.c:568
Modules linked in:
CPU: 1 UID: 0 PID: 6582 Comm: kworker/u9:6 Not tainted 6.16.0-rc7-syzkaller-g82af5ea7c611 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: hci2 hci_conn_timeout
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : hci_conn_timeout+0xf4/0x1e8 net/bluetooth/hci_conn.c:568
lr : hci_conn_timeout+0xf4/0x1e8 net/bluetooth/hci_conn.c:568
sp : ffff8000a5007a70
x29: ffff8000a5007a70 x28: 1ffff00011ed029b x27: dfff800000000000
x26: ffff0000c1bcfb18 x25: ffff0000c4a41000 x24: 1fffe000196e8002
x23: ffff0000cb740000 x22: dfff800000000000 x21: 00000000ffffffff
x20: ffff0000cb894948 x19: ffff0000cb894000 x18: 00000000ffffffff
x17: ffff800093376000 x16: ffff80008af01c68 x15: 0000000000000001
x14: 1fffe00019712802 x13: 0000000000000000 x12: 0000000000000000
x11: ffff600019712803 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000cb740000 x7 : ffff80008042bee0 x6 : 0000000000000000
x5 : ffff800093392da8 x4 : 0000000000000008 x3 : ffff80008a132608
x2 : 0000000000000000 x1 : 00000000ffffffff x0 : 0000000000000000
Call trace:
 hci_conn_timeout+0xf4/0x1e8 net/bluetooth/hci_conn.c:568 (P)
 process_one_work+0x7e8/0x155c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x958/0xed8 kernel/workqueue.c:3402
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
irq event stamp: 1564
hardirqs last  enabled at (1563): [<ffff80008af23384>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last  enabled at (1563): [<ffff80008af23384>] _raw_spin_unlock_irq+0x30/0x80 kernel/locking/spinlock.c:202
hardirqs last disabled at (1564): [<ffff80008aefc634>] el1_brk64+0x1c/0x48 arch/arm64/kernel/entry-common.c:574
softirqs last  enabled at (0): [<ffff8000803ae304>] copy_process+0x112c/0x318c kernel/fork.c:2114
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---
Bluetooth: hci2: command 0x0406 tx timeout