I'm the issue reporter for a related Android 13 issue https://issuetracker.google.com/issues/242755161. Although that issue has now been fixed, our team has discovered a new, potentially related issue.

Devices reproduced on

• Pixel 6 on December update (Android 13 QPR1): TQ1A.221205.011
• Pixel 5 on December update (Android 13 QPR1): TQ1A.221205.011

Observed behavior

Our app triggers bonding with our peripherals by reading an encrypted GATT characteristic, which triggers a security request from the embedded firmware.

After forgetting a bonded peripheral from Bluetooth settings, our app no longer receives a successful onCharacteristicRead callback during subsequent attempts to bond with the peripheral, despite the user confirming the bonding dialog twice.

The issue does not go away with an app uninstall/reinstall and a phone reboot.

Expected behavior

No matter how the bonded peripheral was "forgotten" (either via Bluetooth settings or via something like the private API removeBond()), subsequent attempts to bond with the peripheral by reading its encrypted characteristic should succeed if the user has explicitly confirmed all the bonding dialogs that show up.

Repro steps

Setup

Before reproducing the issue, we first get into a scenario where we're successfully bonded with our peripheral.

1. Start a BLE scan using BluetoothLeScanner.
2. Connect to the BLE peripheral and discover all services.
3. Read an encrypted characteristic to trigger a security request from Android to the peripheral firmware, which in turn triggers a Bluetooth pairing (bonding) dialog to appear to the user.
4. Accept the Bluetooth pairing (bonding) request, which results in the characteristic read succeeding, and the app receives BluetoothGattCallback.onCharacteristicRead with a status of BluetoothGatt.GATT_SUCCESS.
5. We're now successfully bonded with our peripheral.

Getting into the "bad state"

1. While the app is still connected to the BLE peripheral, navigate to Bluetooth settings within the phone's Settings app, and forget the BLE peripheral from the list of saved devices.
2. The app receives an onConnectionStateChange indicating that we're now disconnected since the bond is now broken.
3. The app calls BluetoothGatt.close() to fully tear down the connection.
4. Attempt to bond with the peripheral again following steps 1–5 as described in the "Setup" section above.
5. Observe that two things happen: the system's bonding confirmation dialog now gets shown twice instead of once, and even after confirming this dialog twice, nothing happens and onCharacteristicRead eventually times out with a status code of 133. The bond state of the BluetoothDevice did change briefly from "BONDING" to "BONDED", but we believe this is a false state as subsequent onCharacteristicRead continues to be ignored.

ADB bug report

Google Drive link to adb bugreport archive shared with android-bugreport@google.com.

In this bug report, I went through the steps as outlined in the <Getting into the "bad state"> section above. I then repeated steps 4 and step 5 twice after the initial failure, resulting in three total instances of failure before I ran adb bugreport.