bluetooth: host: legacy scan path silently ignores bt_le_scan_param.timeout #9

Upstream target: zephyrproject-rtos/zephyr — subsys/bluetooth/host/scan.c

bt_le_scan_param.timeout is silently ignored on the legacy scan path. Only start_le_scan_ext() passes a duration to the controller; start_le_scan_legacy() never reads the field. Controllers without extended advertising (so, builds with CONFIG_BT_EXT_ADV=n) therefore scan forever, with no error and no indication the parameter was dropped.

Measured: a timeout=3 scan was still delivering advertisement reports at 57 s / 1600 reports.

The only related validation is valid_le_scan_param(), which rejects a non-zero timeout only under CONFIG_BT_PRIVACY with active scanning — so in the common case the caller gets silent non-compliance rather than -ENOTSUP.

Either the legacy path should enforce the deadline host-side, or bt_le_scan_start() should reject a non-zero timeout when it cannot honour it. Worked around downstream by enforcing the deadline from the application's background task (tyeth/circuitpython#20).

Filed here so it can be raised upstream; not yet submitted to zephyrproject-rtos.