Chrome Version: eve-release/R66-10452.22.0

What steps will reproduce the problem?
Running magic tethering with 1 pixel phone present.

What is the expected result?
It should run smoothly.

What happens instead?
It failed to stop discovery at some point and was unrecoverable. No more LE connection could be created since then. 

The message log showed that kernel tried to send a signal to bluetoothd about the fact that discovering was disabled. But the signal was not observed in dbus traffic, and was not received by bluetoothd either.
 
2018-05-22T17:00:32.279611+08:00 DEBUG kernel: [ 5396.670510] mgmt.c:mgmt_discovering() hci0 discovering 0

Note: The last Discovering PropertiesChanged occurred at 1526979622.014956 in dbus.log. It was 2018-05-22T17:00:22.014956. Hence, the above dbus signal was missing in dbus traffic.

In contrast, a normal signal message would show a signal from kernel to bluetoothd as follows:
2018-05-22T17:00:13.931652+08:00 DEBUG kernel: [ 5378.321867] mgmt.c:mgmt_discovering() hci0 discovering 0                                                                 
2018-05-22T17:00:13.932111+08:00 DEBUG bluetoothd[2638]: src/adapter.c:discovering_callback() hci0 type 6 discovering 0 method 0

The btsnoop log showed that the controller has actually disabled the scanning.
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2   [hci0] 17:00:32.272630
        Scanning: Disabled (0x00)
        Filter duplicates: Disabled (0x00)
> HCI Event: Command Complete (0x0e) plen 4              [hci0] 17:00:32.279065
      LE Set Scan Enable (0x08|0x000c) ncmd 1
        Status: Success (0x00)

At this time, bluetoothd was out of sync with kernel about the discovery_enable state. Hence, a later stop_discovery() command issued by bluetoothd would be rejected as follows:

2018-05-22T17:00:35.877518+08:00 DEBUG bluetoothd[2638]: src/adapter.c:stop_discovery() sender :1.7                                                                          
2018-05-22T17:00:35.879638+08:00 DEBUG kernel: [ 5400.270777] mgmt.c:stop_discovery() hci0                                                                                   
2018-05-22T17:00:35.879479+08:00 DEBUG bluetoothd[2638]: src/adapter.c:stop_discovery_complete() status 0x0b  <-- MGMT_STATUS_REJECTED

I do not know why this happened yet. Marked it as P2 for now as it is not clear about how often we hit this issue.

It is supposed to be a bug across all platforms.

The tarball of logs: https://drive.google.com/open?id=1yPqjOXJ2pOw84Qpgszv0OjVkKovadBXT