Crash when connecting over Bluetooth

[Legoclones]

I got this report when connecting to my Bluetooth headphones.

type: crash
osVersion: google/tokay/tokay:15/AP4A.250205.002/2025021100:user/release-keys
uid: 1002 (u:r:bluetooth:s0)
cmdline: com.android.bluetooth
processUptime: 0s

signal: 11 (SIGSEGV), code 9 (SEGV_MTESERR), faultAddr f00d98913a349d0
threadName: bt_main_thread
MTE: enabled

backtrace:
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (RawAddress::ToRedactedStringForLogging() const+72, pc ac20b8)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (fmt::v10::basic_format_context<fmt::v10::appender, char>::iterator fmt::v10::formatter<RawAddress, char, void>::format<fmt::v10::basic_format_context<fmt::v10::appender, char>>(RawAddress const&, fmt::v10::basic_format_context<fmt::v10::appender, char>&) const+76, pc 343a5c)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (void fmt::v10::detail::value<fmt::v10::basic_format_context<fmt::v10::appender, char>>::format_custom_arg<RawAddress, fmt::v10::formatter<RawAddress, char, void>>(void*, fmt::v10::basic_format_parse_context<char>&, fmt::v10::basic_format_context<fmt::v10::appender, char>&)+144, pc 343450)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (char const* fmt::v10::detail::parse_replacement_field<char, void fmt::v10::detail::vformat_to<char>(fmt::v10::detail::buffer<char>&, fmt::v10::basic_string_view<char>, fmt::v10::detail::vformat_args<char>::type, fmt::v10::detail::locale_ref)::format_handler&>(char const*, char const*, void fmt::v10::detail::vformat_to<char>(fmt::v10::detail::buffer<char>&, fmt::v10::basic_string_view<char>, fmt::v10::detail::vformat_args<char>::type, fmt::v10::detail::locale_ref)::format_handler&)+500, pc bcdda4)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (void fmt::v10::detail::vformat_to<char>(fmt::v10::detail::buffer<char>&, fmt::v10::basic_string_view<char>, fmt::v10::detail::vformat_args<char>::type, fmt::v10::detail::locale_ref)+364, pc bc430c)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (bluetooth::log_internal::vlog(bluetooth::log_internal::Level, char const*, bluetooth::log_internal::source_location, fmt::v10::basic_string_view<char>, fmt::v10::basic_format_args<fmt::v10::basic_format_context<fmt::v10::appender, char>>)+464, pc bddb30)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (BtifAvSource::FindOrCreatePeer(RawAddress const&, unsigned char)+968, pc 735328)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::internal::Invoker<base::internal::BindState<connect_int(RawAddress*, unsigned short)::$_0, RawAddress*, unsigned short>, void ()>::RunOnce(base::internal::BindStateBase*)+64, pc 743d80)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)+204, pc ad685c)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::MessageLoop::RunTask(base::PendingTask*)+360, pc ad5d48)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::MessageLoop::DoWork()+520, pc ad60a8)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+96, pc ad8850)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (base::RunLoop::Run()+72, pc ae5b38)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (bluetooth::common::MessageLoopThread::Run(std::__1::promise<void>)+328, pc ac34f8)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (bluetooth::common::MessageLoopThread::RunThread(bluetooth::common::MessageLoopThread*, std::__1::promise<void>)+56, pc ac3078)
    /apex/com.android.btservices/lib64/libbluetooth_jni.so (void* std::__1::__thread_proxy[abi:nn190000]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (*)(bluetooth::common::MessageLoopThread*, std::__1::promise<void>), bluetooth::common::MessageLoopThread*, std::__1::promise<void>>>(void*)+92, pc ac3ddc)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+132, pc 7ba94)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68, pc 6b474)