Use a valid intersection of a peer interval range and local preferences
when they overlap. Otherwise retain the peer request instead of treating
an initial preference as a hard supported bound.

Validate the original wire request first. Only narrow its interval range;
leave latency, timeout and disjoint-range acceptance unchanged.

Assisted-by: OpenCode:gpt-6.1-sol
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
Changes since v2:
- Wrap test notes to avoid the GitLint B1 failure in series 1186108.
- Refresh onto bluetooth-next ff8b09806b7b; no source delta from v2.

Changes from v1 retained:
- Treat local ranges as preferences, not supported bounds.
- Prefer a valid intersection; otherwise keep the valid peer request.
- Never repair an invalid original request by clipping.
- Preserve latency, supervision timeout and disjoint-range acceptance.

Prior native controls check the accepted L2CAP response and HCI range:
overlap, fast HID fallback, slow idle fallback and exact match. Baseline
passes 3/4; strict bounds pass 2/4 (reject HID/idle); v2 passes 4/4.
The prior reference-guest full L2CAP suite passes 115/115, without skips
or captured KASAN/lockdep alerts. These are prior runs, not fresh v3 VMs.

The independent BlueZ test companion was sent as:
https://lore.kernel.org/r/20261015044221.55631-1-cochcoder@proton.me
Its overlap case intentionally fails without this kernel change.
Completed-interval startup/stream gating remains separate profile work.

The saved v2 CI report lists all jobs except GitLint passing, including
the native L2CAP tester. This is not a remote CI result for v3.
The combined Arch trial is reported working on hardware, not isolated
testing of bluetooth-next or exhaustive device/negative-path coverage.

 net/bluetooth/l2cap_core.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4dd56e007..afde04a19 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5031,6 +5031,19 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 	memset(&rsp, 0, sizeof(rsp));
 
 	err = hci_check_conn_params(min, max, latency, to_multiplier);
+	if (!err) {
+		u16 pref_min = max_t(u16, min, hcon->le_conn_min_interval);
+		u16 pref_max = min_t(u16, max, hcon->le_conn_max_interval);
+
+		/* Local preferences must not reject a valid peer request. */
+		if (pref_min <= pref_max &&
+		    !hci_check_conn_params(pref_min, pref_max, latency,
+					  to_multiplier)) {
+			min = pref_min;
+			max = pref_max;
+		}
+	}
+
 	if (err)
 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
 	else

base-commit: ff8b09806b7b18884ad8d3a2b3d702da534a4e21