r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_read_remote_features={{0x2016, 0x3}}}, 0x6)