Heap disclosure via unbound SDP continuation state

Information disclosure in BlueZ 5.48 and earlier allows physically proximate attackers to read arbitrary bluetoothd heap data via Bluetooth SDP. service_attr_req in sdpd-request.c trusts a supplied CSTATE across consecutive SVC_ATTR_REQ messages without binding it to the original request, so response sizing can exceed the cached buffer. No pairing, privileges, or user interaction is required, but the attacker must be within Bluetooth range; the documented consequence is heap-memory disclosure.