fix(bt): fix BTC task and BLE mesh bluedroid adapter

(cherry picked from commit 678fb93245)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>

components/bt/common/btc/core/btc_task.c

@@ -340,7 +340,10 @@ bt_status_t btc_transfer_context(btc_msg_t *msg, void *arg, int arg_len, btc_arg
 
     memcpy(lmsg, msg, sizeof(btc_msg_t));
     if (arg) {
-        memset(lmsg->arg, 0x00, arg_len);    //important, avoid arg which have no length
+        /* memcpy below covers exactly arg_len bytes, which is the full size of
+         * the destination buffer (it was sized as sizeof(btc_msg_t) + arg_len),
+         * so a prior memset would be redundant. Deep-copy callbacks must only
+         * read fields that were written by the caller-supplied arg. */
         memcpy(lmsg->arg, arg, arg_len);
         if (copy_func) {
             copy_func(lmsg, lmsg->arg, arg);

components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c

@@ -2315,7 +2315,11 @@ static void bt_mesh_bta_gattc_cb(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
         }
         break;
     case BTA_GATTC_CLOSE_EVT:
-        bta_gattc_clcb_dealloc_by_conn_id(p_data->close.conn_id);
+        /* CLCB lifetime is owned by BTA: bta_gattc_close() deallocates the
+         * CLCB right after invoking this synchronous callback. Calling
+         * bta_gattc_clcb_dealloc_by_conn_id() here would be a redundant
+         * double-dealloc (currently a no-op only because of NULL checks in
+         * bta_gattc_clcb_dealloc()). Keep this branch as a pure notification. */
         BT_DBG("BTA_GATTC_CLOSE_EVT");
         break;
     case BTA_GATTC_CONNECT_EVT: {