Bluetooth Firmware -broadcom- Update: Version 2.2.3.593

The next day, the update vanished from the portal. A new version appeared: 2.2.3.594. Release notes: "Removed extraneous diagnostic vendor commands."

She kept a copy of 2.2.3.593 on an air-gapped drive. Not because she wanted to use it — but because sometimes the most interesting stories aren't in the features. They're in the quiet packets no one was supposed to see. bluetooth firmware -broadcom- update version 2.2.3.593

But something else had changed.

Elena noticed it at 3:17 AM, alone in the lab, when she ran btmon in verbose mode. The controller was now sending vendor events for a command she’d never seen: Opcode 0xFC2F — Read ROM Checksum . That wasn’t in the public HCI spec. The next day, the update vanished from the portal

The release notes were dry: - Improved LMP transaction handling for ACL packets - Fixed missing vendor event 0x09 for SCO links - HCI reset now preserves bond info across sleep cycles She backed up the current registry key: HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices . Then the old firmware folder: C:\Windows\System32\drivers\bcbtums.sys (v2.2.3.481). Not because she wanted to use it —

Elena froze. Either Broadcom was telemetrying every Bluetooth chip in the field without disclosure… or someone had slipped a test build into production. She reported it through internal security channels, attaching the packet capture.

Curious, she fired up Wireshark with a Bluetooth USB dongle in monitor mode. Between normal pairing frames, the new firmware was quietly broadcasting tiny packets to a MAC address ending in :00:11:22 — the Broadcom OUI. Not pairing. Not audio. Just tiny pings: 02 03 04 05 06 07 08 09 . Then silence.