bap_bcast_stream_new() shall refuse to create streams if lpac is not of broadcast type. --- Notes: I ran across an unreproducible crash, where during connection dropping a crash occurred IIRC due to stream->rpac == NULL, as if bt_bap_stream_new() had produced a bcast stream for unicast lpac. Not sure if it is actually possible that bt_bap_stream_new() is called from unicast setup when bt_bap_get_att(bap) == false (via gatt_client_ready callback?), but it's probably better to check the lpac type here regardless. src/shared/bap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/shared/bap.c b/src/shared/bap.c index f0c6f6485..854855f6b 100644 --- a/src/shared/bap.c +++ b/src/shared/bap.c @@ -6155,6 +6155,8 @@ static struct bt_bap_stream *bap_bcast_stream_new(struct bt_bap *bap, ep = queue_find(bap->remote_eps, find_ep_source, NULL); if (!ep) return NULL; + } else if (lpac->type != BT_BAP_BCAST_SINK) { + return NULL; } if (!stream) -- 2.49.0