The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (either restart or deadlock the device) by flooding a device with LMP_AU_rand data.
https://www.mi.com/global/mi-true-wireless-earbuds-basic-2/
https://dl.packetstormsecurity.net/papers/general/braktooth.pdf