GAP: Correct the continuous pkt length in l2cap

L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.

Wrong pkt length leading to memory corruption

Hence the Correct the continuous pkt length in
l2cap reassembly logic.

Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
CRs-Fixed: 2434229
Bug: 135239489
diff --git a/hci/src/ b/hci/src/
index 921ac82..c1c61df 100644
--- a/hci/src/
+++ b/hci/src/
@@ -216,7 +216,7 @@
                  "%s got packet which would exceed expected length of %d. "
                  __func__, partial_packet->len);
-        packet->len = partial_packet->len - partial_packet->offset;
+        packet->len = (partial_packet->len - partial_packet->offset) + packet->offset;
         projected_offset = partial_packet->len;