https://devzone.nordicsemi.com/f/nordic-q-a/117653/crash-after-dequeuing-invalid-l2cap-pduHi, I have to develop a BLE peripheral, that communicates larger amounts of data over L2CAP. Establishing the channel between central and peripheral works. I&#39;m able to receive two SDUs and send two SDUs, until I find the application reproducible inen-USTelligent Community 13Thu, 02 Jan 2025 11:28:38 GMThttps://devzone.nordicsemi.com/thread/516629?ContentTypeID=1Thu, 02 Jan 2025 11:28:38 GMT137ad170-7792-4731-bb38-c0d22fbe4515:cb8c3d6a-5a6b-4e05-9fa8-2e818fcab613Torsten Robitzki<p>From a debug session: It seems like the l2cap layer is accessing the buffers user data (which is documented). What is not documented, is the required size, when declaring the buffer pool. The obvious choice would be `sizeof struct closure` from `conn_internal.h`. As this header is not included in the public include path, I was searching for the documented buffer head room:&nbsp;BT_L2CAP_BUF_SIZE. From that search result I extrapolated, that the public available required size could be `CONFIG_BT_CONN_TX_USER_DATA_SIZE` (which is twice the size as&nbsp;<span>`sizeof </span><span>struct closure`, but who cares).</span></p> <p><span>Adding `CONFIG_BT_CONN_TX_USER_DATA_SIZE` as &quot;user&quot;-data size to the definition of the buffer pool, fixes the issue.</span></p><div style="clear:both;"></div>