diff --git a/components/bt/common/ble_log/deprecated/include/ble_log/ble_log_spi_out.h b/components/bt/common/ble_log/deprecated/include/ble_log/ble_log_spi_out.h
index f1e485fa7d4..e2fd663c06b 100644
--- a/components/bt/common/ble_log/deprecated/include/ble_log/ble_log_spi_out.h
+++ b/components/bt/common/ble_log/deprecated/include/ble_log/ble_log_spi_out.h
@@ -11,6 +11,7 @@
 #include "driver/spi_master.h"
 #include "driver/gpio.h"
 #include "esp_timer.h"
+#include "freertos/FreeRTOS.h"
 #include "freertos/semphr.h"
 #include "esp_heap_caps.h"
 #include "esp_task.h"
diff --git a/components/bt/controller/lib_esp32h4/esp32h4-bt-lib b/components/bt/controller/lib_esp32h4/esp32h4-bt-lib
index 37abc16eb00..1d421a2a046 160000
--- a/components/bt/controller/lib_esp32h4/esp32h4-bt-lib
+++ b/components/bt/controller/lib_esp32h4/esp32h4-bt-lib
@@ -1 +1 @@
-Subproject commit 37abc16eb00e2fa130c59f7f59de323a3720c5fb
+Subproject commit 1d421a2a046a75998fd5edc98d5d6a32e7506d5c
diff --git a/components/bt/controller/lib_esp32s31/esp32s31-bt-lib b/components/bt/controller/lib_esp32s31/esp32s31-bt-lib
index f1bfa1e2ec0..f8b5deaeda9 160000
--- a/components/bt/controller/lib_esp32s31/esp32s31-bt-lib
+++ b/components/bt/controller/lib_esp32s31/esp32s31-bt-lib
@@ -1 +1 @@
-Subproject commit f1bfa1e2ec0fb10e3c02fa823ce621d749b0e9d6
+Subproject commit f8b5deaeda9eea8d7d639b2b11f066a64d72cdd3
diff --git a/components/bt/controller/linker_esp_btdm_controller.lf b/components/bt/controller/linker_esp_btdm_controller.lf
index 5b4b4c262eb..05111c9dd1d 100644
--- a/components/bt/controller/linker_esp_btdm_controller.lf
+++ b/components/bt/controller/linker_esp_btdm_controller.lf
@@ -5,6 +5,7 @@ entries:
 [sections:high_perf_iram_text]
 entries:
     .iram_high_perf+
+    .critical_iram+
 
 [sections:adv_fast_execute_code_iram_text]
 entries:
diff --git a/components/bt/porting_btdm/controller/ble/src/ble.c b/components/bt/porting_btdm/controller/ble/src/ble.c
index 27b12e5ecb7..d378211d092 100644
--- a/components/bt/porting_btdm/controller/ble/src/ble.c
+++ b/components/bt/porting_btdm/controller/ble/src/ble.c
@@ -123,7 +123,7 @@ void api_adv_hci_enableScanReqRxdVsEvent(bool en);
 void api_conn_hci_enableChanMapUpdCompVsEvent(bool en);
 #endif // UC_BT_CTRL_LE_VS_CMD_EVT_ENABLED
 
-void r_sched_txn_bredrIsEnabled(bool en);
+void api_sched_txn_bredrIsEnabled(bool en);
 
 /*
  ***************************************************************************************************
@@ -318,7 +318,7 @@ ble_stack_enable(void)
 #endif // UC_BT_CTRL_LE_VS_CMD_EVT_ENABLED
 
 #if UC_BT_CTRL_BR_EDR_IS_ENABLE
-    r_sched_txn_bredrIsEnabled(true);
+    api_sched_txn_bredrIsEnabled(true);
 #endif // UC_BT_CTRL_BR_EDR_IS_ENABLE
 
     return 0;
diff --git a/components/bt/porting_btdm/controller/btdm_common/include/btdm_mem_debug.h b/components/bt/porting_btdm/controller/btdm_common/include/btdm_mem_debug.h
index b496608512c..748a6c1973a 100644
--- a/components/bt/porting_btdm/controller/btdm_common/include/btdm_mem_debug.h
+++ b/components/bt/porting_btdm/controller/btdm_common/include/btdm_mem_debug.h
@@ -18,7 +18,7 @@ extern "C" {
  * Set to 0 to compile out the tracking hooks.
  */
 #ifndef BTDM_MEM_DEBUG
-#define BTDM_MEM_DEBUG 1
+#define BTDM_MEM_DEBUG (0)
 #endif
 
 #if BTDM_MEM_DEBUG
diff --git a/components/bt/porting_btdm/controller/btdm_common/src/btdm_log.c b/components/bt/porting_btdm/controller/btdm_common/src/btdm_log.c
index ffb422c8a93..295b2ad30dc 100644
--- a/components/bt/porting_btdm/controller/btdm_common/src/btdm_log.c
+++ b/components/bt/porting_btdm/controller/btdm_common/src/btdm_log.c
@@ -53,6 +53,7 @@ typedef enum {
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 void r_btdm_sched_list_details_dump(void);
 void api_base_ll_dumpDebugStatus(void);
+void api_sched_txn_dumpListDetails(void);
 void r_ble_phy_hw_state_dump(uint8_t);
 void esp_ble_controller_log_dump_all(bool);
 void esp_panic_handler_feed_wdts(void);
@@ -370,6 +371,7 @@ btdm_log_exception_dump(void)
 #if CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
     api_base_ll_dumpDebugStatus();
     r_btdm_sched_list_details_dump();
+    api_sched_txn_dumpListDetails();
     esp_ble_controller_log_dump_all(true);
 #endif // CONFIG_BT_LE_CONTROLLER_LOG_ENABLED
 }
diff --git a/components/bt/porting_btdm/controller/btdm_common/src/btdm_mem_debug.c b/components/bt/porting_btdm/controller/btdm_common/src/btdm_mem_debug.c
index 4f01046d3c4..2534d533034 100644
--- a/components/bt/porting_btdm/controller/btdm_common/src/btdm_mem_debug.c
+++ b/components/bt/porting_btdm/controller/btdm_common/src/btdm_mem_debug.c
@@ -5,6 +5,7 @@
  */
 
 #include "btdm_mem_debug.h"
+#include "btdm_user_cfg.h"
 #include <stdint.h>
 
 #if BTDM_MEM_DEBUG
@@ -21,12 +22,16 @@ typedef struct {
     void *ptr;
     uint32_t size;
     uint32_t seq;
+    const char *func;
+    uint32_t line;
 } btdm_mem_debug_entry_t;
 
 static btdm_mem_debug_entry_t s_mem_dbg_tbl[BTDM_MEM_DEBUG_MAX];
 static uint32_t s_mem_dbg_seq;
 static uint32_t s_mem_dbg_count;
 static portMUX_TYPE s_mem_dbg_lock = portMUX_INITIALIZER_UNLOCKED;
+static const char *s_mem_dbg_func_name = NULL;
+static uint32_t s_mem_dbg_line_num = 0;
 
 void
 btdm_mem_debug_record(void *ptr, uint32_t size)
@@ -45,12 +50,18 @@ btdm_mem_debug_record(void *ptr, uint32_t size)
             s_mem_dbg_tbl[i].ptr = ptr;
             s_mem_dbg_tbl[i].size = size;
             s_mem_dbg_tbl[i].seq = s_mem_dbg_seq;
+            s_mem_dbg_tbl[i].func = s_mem_dbg_func_name;
+            s_mem_dbg_tbl[i].line = s_mem_dbg_line_num;
             s_mem_dbg_count++;
+
+            s_mem_dbg_func_name = NULL;
+            s_mem_dbg_line_num = 0;
             portEXIT_CRITICAL(&s_mem_dbg_lock);
             return;
         }
     }
-
+    s_mem_dbg_func_name = NULL;
+    s_mem_dbg_line_num = 0;
     portEXIT_CRITICAL(&s_mem_dbg_lock);
     esp_rom_printf("[BTDM_MEM] record full, drop ptr=%p size=%u\n", ptr, (unsigned)size);
 }
@@ -90,6 +101,8 @@ btdm_mem_debug_dump(void)
     uint32_t seq;
     uint32_t count = 0;
     uint32_t total_size = 0;
+    const char *func = NULL;
+    uint32_t line = 0;
 
     esp_rom_printf("[BTDM_MEM] ===== unfreed dump begin =====\n");
 
@@ -98,11 +111,13 @@ btdm_mem_debug_dump(void)
         ptr = s_mem_dbg_tbl[i].ptr;
         size = s_mem_dbg_tbl[i].size;
         seq = s_mem_dbg_tbl[i].seq;
+        func = s_mem_dbg_tbl[i].func;
+        line = s_mem_dbg_tbl[i].line;
         portEXIT_CRITICAL(&s_mem_dbg_lock);
 
         if (ptr != NULL) {
-            esp_rom_printf("[BTDM_MEM] ptr=%p size=%u seq=%u\n",
-                           ptr, (unsigned)size, (unsigned)seq);
+            esp_rom_printf("[BTDM_MEM] ptr=%p size=%u seq=%u, func=%s, line=%u\n", ptr,
+                           (unsigned)size, (unsigned)seq, func ? func : "unknown", line);
             count++;
             total_size += size;
         }
@@ -144,4 +159,13 @@ btdm_mem_debug_get_seq_num(void)
     return sequence;
 }
 
+void
+ext_btdm_mem_debug_hook(const char *func, uint32_t line)
+{
+    if (s_mem_dbg_func_name == NULL) {
+        s_mem_dbg_func_name = func;
+        s_mem_dbg_line_num = line;
+    }
+}
+
 #endif /* BTDM_MEM_DEBUG */
diff --git a/components/bt/porting_btdm/controller/btdm_common/src/btdm_osal_freertos.c b/components/bt/porting_btdm/controller/btdm_common/src/btdm_osal_freertos.c
index f3ee9c6a6de..3c4c4300704 100644
--- a/components/bt/porting_btdm/controller/btdm_common/src/btdm_osal_freertos.c
+++ b/components/bt/porting_btdm/controller/btdm_common/src/btdm_osal_freertos.c
@@ -11,6 +11,7 @@
 #include "btdm_osal_freertos.h"
 #include "btdm_user_cfg.h"
 #include "btdm_mempool.h"
+#include "btdm_mem_debug.h"
 
 #include "esp_mac.h"
 #include "esp_heap_caps.h"
@@ -1047,12 +1048,22 @@ wr_btdm_osal_malloc(uint32_t size, btdm_osal_malloc_flag_t flags)
         ptr = heap_caps_malloc(size, MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT | MALLOC_CAP_DMA);
     }
 
+#if BTDM_MEM_DEBUG
+    if (ptr) {
+        btdm_mem_debug_record(ptr, size);
+    }
+#endif // BTDM_MEM_DEBUG
+
     return ptr;
 }
 
 void
 wr_btdm_osal_free(void *ptr)
 {
+#if BTDM_MEM_DEBUG
+    btdm_mem_debug_clear(ptr);
+#endif // BTDM_MEM_DEBUG
+
     heap_caps_free(ptr);
 }