diff --git a/Android.bp b/Android.bp
index 2b49380..b069650 100644
--- a/Android.bp
+++ b/Android.bp
@@ -66,3 +66,15 @@
         "AndroidTestTemplate.xml",
     ],
 }
+
+filegroup {
+    name: "framework-bluetooth-srcs",
+    srcs: [],
+    visibility: ["//visibility:private"]
+}
+
+java_library {
+    name: "framework-bluetooth",
+    srcs: [":framework-bluetooth-srcs"],
+    sdk_version: "module_current"
+}
diff --git a/apex/Android.bp b/apex/Android.bp
index c206dca..676623a 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -35,3 +35,12 @@
     name: "com.android.bluetooth.updatable.certificate",
     certificate: "com.android.bluetooth.updatable",
 }
+
+// Empty, disabled APEX to allow other libraries to specify "apex_available"
+// in all branches without merge conflicts.
+apex {
+    name: "com.android.bluetooth",
+    enabled: false,
+    key: "com.android.bluetooth.updatable.key",
+    certificate: ":com.android.bluetooth.updatable.certificate",
+}
diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc
index b826dc1..16454a5 100644
--- a/stack/l2cap/l2c_ble.cc
+++ b/stack/l2cap/l2c_ble.cc
@@ -811,6 +811,11 @@
 
     case L2CAP_CMD_CREDIT_BASED_RECONFIG_RES: {
       uint16_t result;
+      if (p + sizeof(uint16_t) > p_pkt_end) {
+        android_errorWriteLog(0x534e4554, "212694559");
+        LOG(ERROR) << "invalid read";
+        return;
+      }
       STREAM_TO_UINT16(result, p);
 
       L2CAP_TRACE_DEBUG(