Merge branch 'bugfix/espat-2446' into 'master'

fix(ESPAT-2446): Fix null pointer crash during periodic advertising scan

See merge request application/esp-at!1926

Author: xcguang

patches/patch_list.ini

@@ -90,3 +90,10 @@
     target = esp32c61
     when = after_sdkconfig
     dependency = CONFIG_AT_BLUFI_COMMAND_SUPPORT
+
+[sync-periodic-broadcast.patch]
+    description = "[ESPAT-2446] Fix null pointer crash during periodic advertising scan"
+    path = esp-idf/components/bt/host/nimble/nimble
+    target = esp32c61
+    when = after_sdkconfig
+    dependency = CONFIG_AT_BLE_COMMAND_SUPPORT

patches/sync-periodic-broadcast.patch

@@ -0,0 +1,95 @@
+From c6026127e180d09ef38a0eac28b49c140617b470 Mon Sep 17 00:00:00 2001
+From: xiewenxiang <[email protected]>
+Date: Mon, 13 Oct 2025 10:46:24 +0800
+Subject: [PATCH] bugfix(espat-2446): workaround sync periodic broadcast crash
+ issue
+
+---
+ nimble/host/src/ble_gap.c | 37 +++++++++++++++++++++++++++----------
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+diff --git a/nimble/host/src/ble_gap.c b/nimble/host/src/ble_gap.c
+index 4c0002d53..279f86f51 100644
+--- a/nimble/host/src/ble_gap.c
++++ b/nimble/host/src/ble_gap.c
+@@ -2304,6 +2304,7 @@ ble_gap_rx_peroidic_adv_sync_estab(const struct ble_hci_ev_le_subev_periodic_adv
+     struct ble_gap_event event;
+     ble_gap_event_fn *cb;
+     void *cb_arg;
++    struct ble_hs_periodic_sync *psync_local;
+ #if MYNEWT_VAL(BLE_ENABLE_CONN_REATTEMPT) && NIMBLE_BLE_CONNECT
+     int rc;
+ #endif
+@@ -2316,7 +2317,24 @@ ble_gap_rx_peroidic_adv_sync_estab(const struct ble_hci_ev_le_subev_periodic_adv
+ 
+     BLE_HS_DBG_ASSERT(ble_gap_sync.psync);
+ 
++    psync_local = ble_gap_sync.psync;
++
+     if (!ev->status) {
++
++        if (!psync_local) {
++            cb = ble_gap_sync.cb;
++            cb_arg = ble_gap_sync.cb_arg;
++            ble_gap_sync.op = BLE_GAP_OP_NULL;
++            ble_gap_sync.cb_arg = NULL;
++            ble_gap_sync.psync = NULL;
++            ble_gap_event_listener_call(&event);
++            if (cb) {
++                cb(&event, cb_arg);
++            }
++            ble_hs_unlock();
++            return;
++        }
++
+         sync_handle = le16toh(ev->sync_handle);
+ 
+ #if MYNEWT_VAL(BLE_ENABLE_CONN_REATTEMPT) && NIMBLE_BLE_CONNECT
+@@ -2324,17 +2342,17 @@ ble_gap_rx_peroidic_adv_sync_estab(const struct ble_hci_ev_le_subev_periodic_adv
+             ble_conn_reattempt.sync_reattempt = 0;
+         }
+ #endif
+-        ble_gap_sync.psync->sync_handle = sync_handle;
+-        ble_gap_sync.psync->adv_sid = ev->sid;
+-        memcpy(ble_gap_sync.psync->advertiser_addr.val, ev->peer_addr, 6);
+-        ble_gap_sync.psync->advertiser_addr.type = ev->peer_addr_type;
++        psync_local->sync_handle = sync_handle;
++        psync_local->adv_sid = ev->sid;
++        memcpy(psync_local->advertiser_addr.val, ev->peer_addr, 6);
++        psync_local->advertiser_addr.type = ev->peer_addr_type;
+ 
+-        ble_gap_sync.psync->cb = ble_gap_sync.cb;
+-        ble_gap_sync.psync->cb_arg = ble_gap_sync.cb_arg;
++        psync_local->cb = ble_gap_sync.cb;
++        psync_local->cb_arg = ble_gap_sync.cb_arg;
+ 
+         event.periodic_sync.sync_handle = sync_handle;
+         event.periodic_sync.sid = ev->sid;
+-        event.periodic_sync.adv_addr = ble_gap_sync.psync->advertiser_addr;
++        event.periodic_sync.adv_addr = psync_local->advertiser_addr;
+         event.periodic_sync.adv_phy = ev->phy;
+         event.periodic_sync.per_adv_ival = ev->interval;
+         event.periodic_sync.adv_clk_accuracy = ev->aca;
+@@ -2345,9 +2363,9 @@ ble_gap_rx_peroidic_adv_sync_estab(const struct ble_hci_ev_le_subev_periodic_adv
+         event.periodic_sync.response_slot_spacing = ev->response_slot_spacing;
+ #endif
+ 
+-        ble_hs_periodic_sync_insert(ble_gap_sync.psync);
++        ble_hs_periodic_sync_insert(psync_local);
+     } else {
+-        ble_hs_periodic_sync_free(ble_gap_sync.psync);
++        ble_hs_periodic_sync_free(psync_local);
+ #if MYNEWT_VAL(BLE_ENABLE_CONN_REATTEMPT) && NIMBLE_BLE_CONNECT
+         if (ev->status == BLE_ERR_CONN_ESTABLISHMENT) {
+             if (ble_conn_reattempt.count < MAX_REATTEMPT_ALLOWED) {
+@@ -2385,7 +2403,6 @@ ble_gap_rx_peroidic_adv_sync_estab(const struct ble_hci_ev_le_subev_periodic_adv
+ 
+     ble_gap_sync.op = BLE_GAP_OP_NULL;
+     ble_gap_sync.cb_arg = NULL;
+-    ble_gap_sync.cb_arg = NULL;
+     ble_gap_sync.psync = NULL;
+ 
+     ble_gap_event_listener_call(&event);
+-- 
+2.39.5 (Apple Git-154)
+