BLE Link Layer behavior for "barge-in attack"?

[Elias]

This is a more specific counterpart to a question I posted on StackExchange. If you want to know more about the attack itself, check that out, but here, I'm asking for a specific behavior that the attack takes advantage of. I'm going to refer to Devices A and B, which are in an active unencrypted connection.

When the Link Layer of Device A receives an invalid packet, it transmits a reply with a non-incremented Next Expected Sequence Number, which signals to Device B's Link Layer that it should re-transmit the packet. Is there a limit from the perspective of Device B on how many times this can happen? If it's receiving valid packets, the channel is apparently usable, but none of the packets it's transmitting are apparently getting through.

Will Device B just keep trying to re-transmit the same packet as long as Device A keeps asking for it?

[endnode]

I've also read your attack scenario several times again and I believe it is not applicable. Once any timeout kicks-in then device terminates the link so you cannot force one peer by jamming the packets to disconnect from legitimate target and then stay connected to "attacker". Or maybe I haven't understood how exactly this attack should work. From my 4-year experience and several security analysis there is just relay/MITM attack possible (you really need to "block" packets from one peer and mimic it by sending your own packets towards second peer + vice versa for the other direction) or dumb DoS (jamming whole spectrum or just particular channel + time to disturb either Tx or Rx windows). Both are pretty easy to execute (basic BLE knowledge and any dev kit will do the job).