Code: int btpan_tap_send(int tap_fd, const BD_ADDR src, const BD_ADDR dst, UINT16 proto, const char* buf,
                    UINT16 len, BOOLEAN ext, BOOLEAN forward)
{
    UNUSED(ext);
    UNUSED(forward);
 if (tap_fd != INVALID_FD)
 {
        tETH_HDR eth_hdr;
        memcpy(&eth_hdr.h_dest, dst, ETH_ADDR_LEN);
        memcpy(&eth_hdr.h_src, src, ETH_ADDR_LEN);
        eth_hdr.h_proto = htons(proto);
 char packet[TAP_MAX_PKT_WRITE_LEN + sizeof(tETH_HDR)];
        memcpy(packet, &eth_hdr, sizeof(tETH_HDR));
 if (len > TAP_MAX_PKT_WRITE_LEN)
 {
            LOG_ERROR("btpan_tap_send eth packet size:%d is exceeded limit!", len);
 return -1;
 }

         memcpy(packet + sizeof(tETH_HDR), buf, len);
 
         /* Send data to network interface */
        int ret = write(tap_fd, packet, len + sizeof(tETH_HDR));
         BTIF_TRACE_DEBUG("ret:%d", ret);
         return ret;
     }
 return -1;

}

Vulnerability Type: DoS 
CWE ID: CWE-284
Summary: Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of Bluetooth 911 functionality) via a crafted application that sends a signal to a Bluetooth process, aka internal bug 28885210.
Commit Message: DO NOT MERGE Fix potential DoS caused by delivering signal to BT process

Bug: 28885210
Change-Id: I63866d894bfca47464d6e42e3fb0357c4f94d360

 Conflicts:
	btif/co/bta_hh_co.c
	btif/src/btif_core.c
Merge conflict resolution of ag/1161415 (referencing ag/1164670)
- Directly into mnc-mr2-release
