BLE device bricked after disconnect with CONFIG_BT_APP_PASSKEY=y on nRF54L15 (Zephyr 4.3.0)

[devitwise]

Describe the bug

Summary
After enabling CONFIG_BT_APP_PASSKEY=y, the device becomes bricked after each BLE disconnect on nRF54L15. Even after reset and BLE initialization, the core enters a bricked state—only erasing firmware helps.
Environment

Zephyr version: 4.3.0
Hardware: Nordic nRF54L15
Configuration: BLE with passkey enabled

Steps to Reproduce

Enable CONFIG_BT_APP_PASSKEY=y in prj.conf
Build and flash the application
Connect via BLE and disconnect
Observe device becomes unresponsive

Expected Behavior
Device should handle BLE disconnections gracefully and remain responsive.
Actual Behavior
Device enters a bricked state after disconnect. Debugger shows the core stuck in an infinite loop.
Troubleshooting Attempted

Disabled CONFIG_BT_SETTINGS=n → No effect
Disabled CONFIG_BT_CTLR_PRIVACY=n → Resolves the issue (but not ideal)

Debug Output
The core is stuck in an infinite loop in
zephyr/subsys/bluetooth/controller/ll_sw/nordic/hal/nrf5/radio/radio.c
in the radio_ar_has_match() function:

uint32_t radio_ar_has_match(void)
{
	if (!radio_bc_has_match()) {
		return 0U;
	}

	nrf_aar_int_enable(NRF_AAR, AAR_INTENSET_END_Msk);

	// Infinite loop - never returns:
	while (NRF_AAR->EVENTS_END == 0U) {
		cpu_sleep();
	}

	nrf_aar_int_disable(NRF_AAR, AAR_INTENCLR_END_Msk);
	NVIC_ClearPendingIRQ(nrfx_get_irq_number(NRF_AAR));

	if (NRF_AAR->EVENTS_RESOLVED && !NRF_AAR->EVENTS_NOTRESOLVED) {
		return 1U;
	}

	return 0U;
}

The NRF_AAR->EVENTS_END event never gets set, causing the cpu_sleep() loop to never exit.
Current Workaround
Disable privacy:
properties CONFIG_BT_CTLR_PRIVACY=n
This resolves the issue but likely disables an important security feature.

[github-actions]

Hi @devitwise! We appreciate you submitting your first issue for our open-source project. 🌟

Even though I'm a bot, I can assure you that the whole community is genuinely grateful for your time and effort. 🤖💙