--- x/net/bluetooth/mgmt.c
+++ y/net/bluetooth/mgmt.c
@@ -2538,7 +2538,7 @@ static int send_hci_cmd_sync(struct hci_
 	struct sk_buff *skb;
 
 	skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode),
-				le16_to_cpu(cp->params_len), cp->params,
+				cmd->param_len, cmd->param,
 				cp->event, cp->timeout ?
 				secs_to_jiffies(cp->timeout) :
 				HCI_CMD_TIMEOUT);