Assert when executing GATT/SR/GAW/BV-14-C test

[sjanc]

Describe the bug

When executing GATT/SR/GAW/BV-14-C Zephyr crashes (asserts). This test is is server prepare write test over multiple bearers (EATT is disconnected in between of prepare writes) and this is causing problems on Execute Write command.

To Reproduce
Execute GATT/SR/GAW/BV-14-C qualification test case (PTS 8.4.1)

Expected behavior
Test pass

Impact
What impact does this issue have on your progress (e.g., annoyance, showstopper)

Logs and console output

Backtrace

arch_system_halt (reason=reason@entry=4) at C:/Users/Szymon/zephyrproject/zephyr/kernel/fatal.c:32
32              for (;;) {
(gdb) bt
#0  arch_system_halt (reason=reason@entry=4) at C:/Users/Szymon/zephyrproject/zephyr/kernel/fatal.c:32
#1  0x00034096 in k_sys_fatal_error_handler (reason=reason@entry=4, esf=esf@entry=0x2000acb8 <recv_thread_stack+760>)
    at C:/Users/Szymon/zephyrproject/zephyr/kernel/fatal.c:46
#2  0x00034170 in z_fatal_error (reason=reason@entry=4, esf=esf@entry=0x2000acb8 <recv_thread_stack+760>)
    at C:/Users/Szymon/zephyrproject/zephyr/kernel/fatal.c:131
#3  0x0000b248 in z_arm_fatal_error (reason=4, esf=0x2000acb8 <recv_thread_stack+760>)
    at C:/Users/Szymon/zephyrproject/zephyr/arch/arm/core/aarch32/fatal.c:63
#4  0x0000b44a in _oops () at C:/Users/Szymon/zephyrproject/zephyr/arch/arm/core/aarch32\swap_helper.S:570
#5  <signal handler called>
#6  assert_post_action (file=0x4 <bt_data_parse+4> "\021½", file@entry=0x41b5d "WEST_TOPDIR/zephyr/tests/bluetooth/tester/src/btp_gatt.c",
    line=line@entry=418) at C:/Users/Szymon/zephyrproject/zephyr/lib/os/assert.c:43
#7  0x00006220 in write_value (conn=<optimized out>, attr=0x20004970 <server_db+800>, buf=0x2000f1e0 <net_buf_data_reassembled_data>,
    len=<optimized out>, offset=0, flags=4 '\004') at C:/Users/Szymon/zephyrproject/zephyr/tests/bluetooth/tester/src/btp_gatt.c:418
#8  0x0003b8c2 in write_cb (attr=0x20004970 <server_db+800>, handle=<optimized out>, user_data=0x2000ad88 <recv_thread_stack+968>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/att.c:1963
#9  0x0003c634 in gatt_foreach_iter (attr=0x20004970 <server_db+800>, handle=<optimized out>, start_handle=start_handle@entry=58,
    end_handle=end_handle@entry=58, uuid=uuid@entry=0x0 <bt_data_parse>, attr_data=attr_data@entry=0x0 <bt_data_parse>,
    num_matches=num_matches@entry=0x2000ad46 <recv_thread_stack+902>, func=func@entry=0x3b88d <write_cb>,
    user_data=user_data@entry=0x2000ad88 <recv_thread_stack+968>) at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/gatt.c:1969
#10 0x00015d54 in foreach_attr_type_dyndb (user_data=0x2000ad88 <recv_thread_stack+968>, func=0x3b88d <write_cb>, num_matches=<optimized out>,
    attr_data=0x0 <bt_data_parse>, uuid=0x0 <bt_data_parse>, end_handle=58, start_handle=58)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/gatt.c:2001
#11 bt_gatt_foreach_attr_type (start_handle=<optimized out>, end_handle=<optimized out>, uuid=uuid@entry=0x0 <bt_data_parse>,
    attr_data=attr_data@entry=0x0 <bt_data_parse>, num_matches=<optimized out>, num_matches@entry=0, func=func@entry=0x3b88d <write_cb>,
    user_data=user_data@entry=0x2000ad88 <recv_thread_stack+968>) at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/gatt.c:2050
#12 0x0003b8fe in bt_gatt_foreach_attr (start_handle=start_handle@entry=58, end_handle=end_handle@entry=58, func=func@entry=0x3b88d <write_cb>,
    user_data=user_data@entry=0x2000ad88 <recv_thread_stack+968>) at C:/Users/Szymon/zephyrproject/zephyr/include/zephyr/bluetooth/gatt.h:472
#13 0x000145da in att_write_rsp (chan=chan@entry=0x2000d180 <_k_mem_slab_buf_chan_slab+2688>, req=req@entry=24 '\030', rsp=rsp@entry=0 '\000',
    handle=handle@entry=58, offset=0, value=0x2000f1e0 <net_buf_data_reassembled_data>, len=512)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/att.c:2010
#14 0x000147d4 in att_exec_write_rsp (flags=1 '\001', chan=0x2000d180 <_k_mem_slab_buf_chan_slab+2688>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/att.c:2271
#15 att_exec_write_req (chan=0x2000d180 <_k_mem_slab_buf_chan_slab+2688>, buf=<optimized out>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/att.c:2313
#16 0x00014530 in bt_att_recv (chan=0x2000d188 <_k_mem_slab_buf_chan_slab+2696>, buf=0x2000e750 <_net_buf_hci_rx_pool>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/att.c:2862
#17 0x00012aba in l2cap_chan_le_recv (chan=chan@entry=0x2000d188 <_k_mem_slab_buf_chan_slab+2696>, buf=buf@entry=0x2000e750 <_net_buf_hci_rx_pool>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/l2cap.c:2463
#18 0x00012bd4 in l2cap_chan_recv_queue (buf=0x2000e750 <_net_buf_hci_rx_pool>, chan=0x2000d188 <_k_mem_slab_buf_chan_slab+2696>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/l2cap.c:2491
#19 l2cap_chan_recv (complete=true, buf=0x2000e750 <_net_buf_hci_rx_pool>, chan=0x2000d188 <_k_mem_slab_buf_chan_slab+2696>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/l2cap.c:2509
#20 bt_l2cap_recv (conn=conn@entry=0x20002430 <acl_conns>, buf=0x2000e750 <_net_buf_hci_rx_pool>, complete=complete@entry=true)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/l2cap.c:2558
#21 0x00010bf6 in bt_acl_recv (flags=<optimized out>, buf=<optimized out>, conn=0x20002430 <acl_conns>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/conn.c:368
#22 bt_conn_recv (conn=conn@entry=0x20002430 <acl_conns>, buf=buf@entry=0x2000e750 <_net_buf_hci_rx_pool>, flags=flags@entry=2 '\002')
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/conn.c:386
#23 0x0000deea in hci_acl (buf=0x2000e750 <_net_buf_hci_rx_pool>) at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/hci_core.c:529
#24 bt_recv (buf=buf@entry=0x2000e750 <_net_buf_hci_rx_pool>) at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/host/hci_core.c:3735
#25 0x0001e4b8 in recv_thread (p1=<optimized out>, p2=<optimized out>, p3=<optimized out>)
    at C:/Users/Szymon/zephyrproject/zephyr/subsys/bluetooth/controller/hci/hci_driver.c:664
#26 0x000386fa in z_thread_entry (entry=0x1e405 <recv_thread>, p1=<optimized out>, p2=<optimized out>, p3=<optimized out>)
    at C:/Users/Szymon/zephyrproject/zephyr/lib/os/thread_entry.c:36
#27 0x000386fa in z_thread_entry (entry=0x1e405 <recv_thread>, p1=<optimized out>, p2=<optimized out>, p3=<optimized out>)
    at C:/Users/Szymon/zephyrproject/zephyr/lib/os/thread_entry.c:36
#28 0x00000000 in ?? ()

HCI traces (CFA):
gatt_sr_gaw_bv_14_c.f.zip

[kruithofa]

This is probably a bug in the tests/bluetooth/tester application. Jonathan to investigate