Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.