fix: Fix the critical issues of btu and bt_common from AI review report

- advance connect queue on synchronous connect_cb failure
- lock bta_alarm_hash_map in all BTA timer APIs
- free controller params after stack disable; cleanup on init fail
- handle BTE_InitStack failure and signal init future
- validate HCI remote name event length before parse
- drop stale L2CAP quick-timer alarm events

components/bt/host/bluedroid/btc/core/btc_main.c

@@ -18,6 +18,8 @@
 #include "bta_dm_int.h"
 
 static future_t *main_future[BTC_MAIN_FUTURE_NUM];
+static SemaphoreHandle_t s_init_done_sem = NULL;
+static bool s_init_clean = false;
 
 extern int bte_main_boot_entry(void *cb);
 extern int bte_main_shutdown(void);
@@ -44,18 +46,46 @@ static void btc_disable_bluetooth(void)
     }
 }
 
-void btc_init_callback(void)
+void btc_init_callback(bt_status_t status)
 {
-    future_ready(*btc_main_get_future_p(BTC_MAIN_INIT_FUTURE), FUTURE_SUCCESS);
+    s_init_clean = (status == BT_STATUS_SUCCESS) ? false : true;
+    future_ready(*btc_main_get_future_p(BTC_MAIN_INIT_FUTURE),
+                 (status == BT_STATUS_SUCCESS) ? FUTURE_SUCCESS : FUTURE_FAIL);
+}
+
+void btc_cleanup_partial_init(void)
+{
+    if (s_init_clean) {
+        xSemaphoreTake(s_init_done_sem, portMAX_DELAY);
+        bte_main_shutdown();
+#if (SMP_INCLUDED)
+        btc_config_clean_up();
+#endif
+        osi_alarm_deinit();
+        osi_alarm_delete_mux();
+#if BTA_DYNAMIC_MEMORY
+        vSemaphoreDelete(deinit_semaphore);
+        deinit_semaphore = NULL;
+#endif /* #if BTA_DYNAMIC_MEMORY */
+        vSemaphoreDelete(s_init_done_sem);
+        s_init_done_sem = NULL;
+        s_init_clean = false;
+    } else {
+        if (s_init_done_sem) {
+            vSemaphoreDelete(s_init_done_sem);
+            s_init_done_sem = NULL;
+        }
+        osi_alarm_deinit();
+        osi_alarm_delete_mux();
+    }
 }
 
 static void btc_init_bluetooth(void)
 {
     osi_alarm_create_mux();
     osi_alarm_init();
-    if (bte_main_boot_entry(btc_init_callback) != 0) {
-        osi_alarm_deinit();
-        osi_alarm_delete_mux();
+    s_init_done_sem = xSemaphoreCreateBinary();
+    if ((s_init_done_sem == NULL) || (bte_main_boot_entry(btc_init_callback) != 0)) {
         future_ready(*btc_main_get_future_p(BTC_MAIN_INIT_FUTURE), FUTURE_FAIL);
         return;
     }
@@ -71,6 +101,7 @@ static void btc_init_bluetooth(void)
 #if BTA_DYNAMIC_MEMORY
     deinit_semaphore = xSemaphoreCreateBinary();
 #endif /* #if BTA_DYNAMIC_MEMORY */
+    xSemaphoreGive(s_init_done_sem);
 }
 
 
@@ -98,6 +129,10 @@ static void btc_deinit_bluetooth(void)
     vSemaphoreDelete(deinit_semaphore);
     deinit_semaphore = NULL;
 #endif /* #if BTA_DYNAMIC_MEMORY */
+    if (s_init_done_sem) {
+        vSemaphoreDelete(s_init_done_sem);
+        s_init_done_sem = NULL;
+    }
 }
 
 void btc_main_call_handler(btc_msg_t *msg)

components/bt/host/bluedroid/btc/core/btc_profile_queue.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -144,7 +144,11 @@ bt_status_t btc_queue_connect_next(void)
     }
 
     p_head->busy = true;
-    return p_head->connect_cb(&p_head->bda, p_head->uuid);
+    bt_status_t status = p_head->connect_cb(&p_head->bda, p_head->uuid);
+    if (status != BT_STATUS_SUCCESS) {
+        btc_queue_advance();
+    }
+    return status;
 }
 
 

components/bt/host/bluedroid/btc/include/btc/btc_main.h

@@ -69,4 +69,5 @@ void btc_deinit_bluetooth(future_t *future);
 #endif
 
 void btc_main_call_handler(btc_msg_t *msg);
+void btc_cleanup_partial_init(void);
 #endif /* __BTC_BT_MAIN_H__ */