`bt_hci_lmp_acl_data_slave()` calls to `hci_from_device(btlink->slave)`, which assumes current slave is a data member from an instance of __struct bt_hci_s__, and the remove device created here is certainly not this case.