## Summary

`kernel-7.0.x-*.fc44` breaks all BLE advertising registration via the BlueZ
D-Bus `LEAdvertisingManager1.RegisterAdvertisement` API. `bluetoothd` returns
`org.bluez.Error.Failed: Failed to register advertisement`; the kernel rejects
the `MGMT_OP_ADD_EXT_ADV_DATA` command with `Invalid Parameters (0x0d)`.

## Component / Version

- kernel-7.0.11-200.fc44 and kernel-7.0.12-201.fc44 (both affected)
- bluez-5.86-4.fc44
- Reproduced on two unrelated controllers (Realtek RTL8761BU, Nordic nRF) and
  with BlueZ's own `test/example-advertisement` and `bluetoothctl advertise on`,
  i.e. it is not application- or controller-specific.

## Steps to Reproduce

```
bluetoothctl -- advertise on
```

## Actual result

```
Failed to set advertise on
```
`bluetoothd` logs:
```
src/advertising.c:add_client_complete() Failed to add advertisement: Invalid Parameters (0x0d)
```

## Expected result

`Advertising object registered`.

## Root cause (confirmed by HCI/MGMT trace)

`btmon` capture of the failing sequence:

```
@ MGMT Command: Add Extended Advertising Parameters (0x0054) plen 18
        Instance: 1   Flags: 0x00000001 (Connectable)
@ MGMT Event:   Command Complete -> Status: Success (0x00)   Instance: 1

@ MGMT Command: Add Extended Advertising Data (0x0055) plen 14    <-- 14, but real content is 6 bytes
        Instance: 1
        Advertising data length: 3
        Advertising Data[3]: 02 01 06        (standard Flags AD)
        Scan response length: 0
@ MGMT Event:   Command Status -> Status: Invalid Parameters (0x0d)   <-- kernel rejects, no HCI issued
```

`bluetoothd` (`src/advertising.c:add_adv_params_callback`) sizes the
`MGMT_OP_ADD_EXT_ADV_DATA` buffer with `sizeof(struct mgmt_cp_add_advertising)`
(11 bytes) instead of `sizeof(struct mgmt_cp_add_ext_adv_data)` (3 bytes), so it
sends 8 trailing bytes. The kernel handler `add_ext_adv_data()` previously
ignored the slop; kernel commit **d3f7d17960ed** ("Bluetooth: MGMT: validate Add
Extended Advertising Data length", a `Cc: stable` fix for a KASAN slab-out-of-bounds
read) made the length check exact, so the over-long command is now rejected. That
stable backport reached the Fedora 44 kernel; the follow-up relaxation has not.

## Fix — please backport either (or both)

**Kernel** (preferred; restores backward compatibility, follows the stable fix):
```
149324fc762c2a7acef9c26790566f81f475e51f
  Bluetooth: MGMT: Fix backward compatibility with userspace
  Fixes: d3f7d17960ed ("Bluetooth: MGMT: validate Add Extended Advertising Data length")
```

**BlueZ** (fixes the actual defect; makes the command the correct size):
```
2a6968b40378dca5650e18e03ad0407738c47be5
  advertising: Fix sending extra bytes with MGMT_OP_ADD_EXT_ADV_DATA
```


Reproducible: Always