coc_rx.sdus[] is managed by coc_rx.current_sdu_idx and coc_rx.next_sdu_alloc_idx
but ble_l2cap_coc_cleanup_chan() does not check them
Steps to reproduce:
enable MYNEWT_VAL_OS_MEMPOOL_POISON in build
create L2CAP COC connection
exchange some data
close connection
A simple fix that I am using is, in ble_l2cap_coc_rx_fn(), replace
rx_sdu = NULL;
with
rx->sdus[chan->coc_rx.current_sdu_idx] = NULL;
this removes the reference to the mbuf from the stack just before returning it to the application