Acknowledged
CIQQA-4786

fēnix 8: BLE scan drops advertisements from Resolvable Private Addresses of unpaired peripherals (public and static addresses work)

Device: fēnix 8 Solar 47mm (006-B4532-00), firmware 23.39, Connect IQ 6.0.2 / API 6.0.3
SDK: 9.2.0
App type: watch-app

Summary

A connectable peripheral that advertises from a Resolvable Private Address never appears in onScanResults(). The exact same advertising payload sent from a public/static address is delivered normally. So the filtering seems to depend on the address type, not on the payload.

Peripheral

Panasonic LUMIX S5M2 camera. When switched on it advertises ADV_IND (legacy PDU, connectable, scannable) from a Resolvable Private Address. When switched off (Bluetooth standby) it advertises from its public address. The payload is the same in both cases except for one state byte:

02 01 06 | 09 FF 3A 00 00 xx xx xx xx xx | 11 07 1B C5 D5 A5 02 00 0D AC E6 11 14 32 20 C6 4A 05

Scan response: Complete Local Name.

What the app does

  • Registers two profiles (registerProfile, both return STATUS_SUCCESS): the advertised service 054AC620-3214-11E6-AC0D-0002A5D5C51B and the GATT service the app uses afterwards.
  • Starts scanning (SCAN_STATE_SCANNING).
  • Parses ScanResult.getRawData() itself. getDeviceName() and getManufacturerSpecificData() return null for every result on this device, but the raw data is complete.

Results

About 30 s scans, camera less than 1 m from the watch:

Advertiser Address type (per btmon) Seen by the watch
Camera ON Resolvable (e.g. 78:70:F5:xx:xx:xx) never (0 results across 6+ runs)
Camera in standby Public (7C:B8:DA:xx:xx:xx) yes (about 30 results / 30 s)
Linux PC (btmgmt add-adv) with identical payload, state byte 00 Public yes (4–10 results)
Phones/speakers nearby (Apple, Sonos) various yes (hundreds)

A Linux PC (BlueZ) and an Android phone see the camera in all states, and both can connect and use its GATT service without bonding, with MTU 23 and writes of at most 20 bytes. The watch-side flow is therefore expected to work if the scan result reaches the app.

Expected: advertisements from RPA peripherals are delivered to onScanResults() (maybe with the RPA as the address), so the app can pairDevice() with them.
Actual: they are silently dropped.

Questions

  1. Is this intended filtering (e.g. dropping unresolvable RPAs)? If so, is there a way to opt out?
  2. If it is a bug, is a fix planned for fēnix 8?

btmon logs and the test app source are available on request.

Tomasz
  • in reply to jim_m_58

    Note: I accidentally deleted my previous reply, so I've reposted it below together with the new btmon details.

    Thanks Jim – agreed, CIQ's BLE is limited, and that's why I parse ScanResult.getRawData() myself (getDeviceName() and getManufacturerSpecificData() return null anyway).

    But size limits aren't the issue here. Following your tip, I checked the advertisement itself (btmon on Linux, camera <1 m away). In both camera states it's the same kind of packet:
    - Legacy PDU, ADV_IND (connectable, scannable undirected), primary PHY LE 1M, no extended advertising
    - Flags: 0x06 (LE General Discoverable, BR/EDR not supported)
    - 31 bytes of data: flags, manufacturer data (Panasonic, 0x003A) and a 128-bit service UUID

    The only difference is the address type:
    - camera on: Random, 78:70:F5:5C:B9:A8 (Resolvable) → 0 results in 6+ runs
    - camera in standby: Public, 7C:B8:DA:DA:E2:6C → ~30 results per scan
    - identical payload sent from a Linux PC with a public address → delivered

    So the advertisements are dropped based on the address type, not on their content or length. Receiving an RPA advert doesn't require resolving it, and Linux and Android both see the camera and connect to its GATT service without bonding.

    I'll also try your BleScan app and report back. btmon logs and the test app are available if Garmin wants them.

  • If you haven't done this yet, I'd use nRFconnect on my phone and look at the things like the flags/etc in the advertisement.

    Have you tried my BleScan app to see what it says? It updates all the time so it's not just a snapshot.

    https://apps-developer.garmin.com/apps/9bcc8b66-8385-4afb-b93e-f69e01422284

  • CIQ has a very basic and limited implementation of BLE, like you wont even see the device name advertised on many devices due to the 30 or so char max limit exposed in the advertised data, and the very small send and receive limits