size read directly from acl_hdr
static void bt_spi_rx_thread(void)
{
    struct net_buf *buf;
    u8_t header_master[5] = { SPI_READ, 0x00, 0x00, 0x00, 0x00 };
    u8_t header_slave[5];
    struct bt_hci_acl_hdr acl_hdr;
    u8_t size = 0U;
    int ret;

    (void)memset(&txmsg, 0xFF, SPI_MAX_MSG_LEN);
    ...
    switch (rxmsg[PACKET_TYPE]) {
    ...
    case HCI_ACL:
        // Tobias Scharnowski: Constant size buffer
        buf = bt_buf_get_rx(BT_BUF_ACL_IN, K_FOREVER);
        // Tobias Scharnowski: Direct read of potentially untrusted data
into acl header
        memcpy(&acl_hdr, &rxmsg[1], sizeof(acl_hdr));
        net_buf_add_mem(buf, &acl_hdr, sizeof(acl_hdr));
        // Tobias Scharnowski: Use of size without sanitization
        net_buf_add_mem(buf, &rxmsg[5],
                sys_le16_to_cpu(acl_hdr.len));
        break;
    ...
    }
}

// Constant size (defined in `include/bluetooth/buf.h`):
#define BT_BUF_RESERVE CONFIG_BT_HCI_RESERVE
#define BT_BUF_SIZE(size) (BT_BUF_RESERVE + (size))
/** Data size neeed for HCI RX buffers */
#define BT_BUF_RX_SIZE (BT_BUF_SIZE(CONFIG_BT_RX_BUF_LEN))

- CONFIG_BT_HCI_RESERVE defaults to 0/1
- CONFIG_BT_RX_BUF_LEN defaults to 76
-> default full size BT_BUF_RX_SIZE is 77