[nrf noup] bluetooth: att: Fix CONFIG_BT_ATT_SENT_CB_AFTER_TX

The `delay ATT sent callback until data transmission is done by
controller` feature introduces an extra `net_buf` reference which is
removed on sent callback. Make sure to remove the reference on BLE
disconnection to free the buffer as the registered sent callback will
not be called.

Jira: NCSDK-35650

Signed-off-by: Marek Pieta <[email protected]>

Author: MarekPieta

subsys/bluetooth/host/l2cap.c

@@ -274,6 +274,12 @@ static void l2cap_chan_del(struct bt_l2cap_chan *chan)
 	 */
 	while ((buf = k_fifo_get(&le_chan->tx_queue, K_NO_WAIT))) {
 		net_buf_unref(buf);
+		/* The feature might introduce an additional net buffer reference. Remove it to free
+		 * the buffer as the registered sent callback will not be called.
+		 */
+		if (IS_ENABLED(CONFIG_BT_ATT_SENT_CB_AFTER_TX) && (buf->ref == 1)) {
+			net_buf_unref(buf);
+		}
 	}
 
 	if (ops->disconnected) {