Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.