Fix NimBLE queued timer crash when stopping Bluetooth

docs/power_saving_diagnostics.md

@@ -82,6 +82,13 @@ failed teardown keeps the CPU awake rather than treating stopped advertising
 as a stopped controller. `get bluetooth` reports a pending change until that
 transition finishes.
 
+NimBLE-Arduino 2.5.1 builds include the upstream host-timer shutdown fix
+([NimBLE-Arduino #1185](https://github.com/h2zero/NimBLE-Arduino/pull/1185)).
+Stopping Bluetooth preserves an already queued timer event's callback until
+final host cleanup. Without this fix, switching Bluetooth off can reset an
+ESP32 through a null callback. The version/hash-checked repair is applied to a
+build-local source copy; the shared library installation is unchanged.
+
 USB host sessions, logging, active WiFi/ESP-NOW, OTA and serial work keep their
 existing sleep guards. This change does not sleep an ESP32 through a live
 Bluetooth or WiFi connection. Such connections require SDK-managed modem and

docs/test-results/esp32_ble_radio2_sleep_2026-10-21.md

@@ -13,6 +13,18 @@ Bluetooth and SDK wait checks pass. Three strict sleeping RF trials with
 matched preambles received five of six packets, including the trial after the IRQ fix. They remain
 failures; radio2 is not fully qualified.
 
+The subsequent V3 CPU-clock sweep stopped during setup, before any of its
+20-packet-per-frequency cases transmitted. Switching Bluetooth off exposed a
+NimBLE-Arduino 2.5.1 shutdown crash: PC zero in the host task, with the event
+address resolving to `ble_hs_timer + 8`. This matches upstream
+[issue #1184](https://github.com/h2zero/NimBLE-Arduino/issues/1184) and its
+[merged fix #1185](https://github.com/h2zero/NimBLE-Arduino/pull/1185).
+The backport removes premature timer deinitialization while leaving final
+cleanup intact. The earlier V4 Bluedroid checks do not qualify V3 NimBLE.
+The regression reproduces the original null callback, then passes 1,000
+shutdown/cleanup cycles under ASan/UBSan for each timer backend. Library
+version, source hash and build-local middleware checks also pass.
+
 ## Behavior and safeguards
 
 Bluetooth off disconnects clients and completes host/controller teardown in