diff --git a/components/bt/controller/esp32c2/bt.c b/components/bt/controller/esp32c2/bt.c
index 9a37c1c7c1..0e1622ab80 100644
--- a/components/bt/controller/esp32c2/bt.c
+++ b/components/bt/controller/esp32c2/bt.c
@@ -1003,7 +1003,7 @@ uint8_t esp_ble_get_chip_rev_version(void)
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
     for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
     }
     if (end) {
         esp_rom_printf("\n");
diff --git a/components/bt/controller/esp32c6/Kconfig.in b/components/bt/controller/esp32c6/Kconfig.in
index 4140671c44..0e355ab546 100644
--- a/components/bt/controller/esp32c6/Kconfig.in
+++ b/components/bt/controller/esp32c6/Kconfig.in
@@ -212,6 +212,15 @@ menu "Memory Settings"
         help
             Dynamic memory size of block 2
 
+    config BT_LE_MSYS_BUF_FROM_HEAP
+        bool "Get Msys Mbuf from heap"
+        default y
+        depends on BT_LE_MSYS_INIT_IN_CONTROLLER
+        help
+            This option sets the source of the shared msys mbuf memory between
+            the Host and the Controller. Allocate the memory from the heap if
+            this option is sets, from the mempool otherwise.
+
     config BT_LE_ACL_BUF_COUNT
         int "ACL Buffer count"
         default 10
@@ -539,5 +548,5 @@ config BT_LE_SCAN_DUPL_CACHE_REFRESH_PERIOD
         again.
 
 config BT_LE_MSYS_INIT_IN_CONTROLLER
-    bool
+    bool "Msys Mbuf Init in Controller"
     default y
diff --git a/components/bt/controller/esp32c6/bt.c b/components/bt/controller/esp32c6/bt.c
index 4691ba4a6d..0643b525fe 100644
--- a/components/bt/controller/esp32c6/bt.c
+++ b/components/bt/controller/esp32c6/bt.c
@@ -1173,7 +1173,7 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
     for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
     }
     if (end) {
         esp_rom_printf("\n");
diff --git a/components/bt/controller/esp32h2/bt.c b/components/bt/controller/esp32h2/bt.c
index 068387749f..b3361bbb69 100644
--- a/components/bt/controller/esp32h2/bt.c
+++ b/components/bt/controller/esp32h2/bt.c
@@ -1147,7 +1147,7 @@ esp_power_level_t esp_ble_tx_power_get_enhanced(esp_ble_enhanced_power_type_t po
 static void esp_bt_controller_log_interface(uint32_t len, const uint8_t *addr, bool end)
 {
     for (int i = 0; i < len; i++) {
-        esp_rom_printf("%02x,", addr[i]);
+        esp_rom_printf("%02x ", addr[i]);
     }
     if (end) {
         esp_rom_printf("\n");
diff --git a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
index 4fb60aa91d..ea33fbad1f 160000
--- a/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
+++ b/components/bt/controller/lib_esp32c2/esp32c2-bt-lib
@@ -1 +1 @@
-Subproject commit 4fb60aa91de64b0f1d0eb6292d38b6c22a3aa005
+Subproject commit ea33fbad1fa0879fe0e118359d20463b3e2f126b
diff --git a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
index 25d9661bc3..c32ea6a0c2 160000
--- a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
+++ b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
@@ -1 +1 @@
-Subproject commit 25d9661bc3d5cc7bade40c03f501b935d3ad7642
+Subproject commit c32ea6a0c26025c1da8019d38216613686b4a139
diff --git a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
index 8450d3f508..e4a8094f28 160000
--- a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
+++ b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
@@ -1 +1 @@
-Subproject commit 8450d3f50804bc2d685a6ef5c5a76e1f4f13d579
+Subproject commit e4a8094f283e4e477d47f590275f5b33d9c8cf74
diff --git a/components/bt/host/nimble/Kconfig.in b/components/bt/host/nimble/Kconfig.in
index 78ebb14c3d..1a3e63cc99 100644
--- a/components/bt/host/nimble/Kconfig.in
+++ b/components/bt/host/nimble/Kconfig.in
@@ -275,6 +275,15 @@ menu "Memory Settings"
         help
                 Dynamic memory size of block 2
 
+    config BT_NIMBLE_MSYS_BUF_FROM_HEAP
+        bool "Get Msys Mbuf from heap"
+        default y
+        depends on BT_LE_MSYS_INIT_IN_CONTROLLER
+        help
+            This option sets the source of the shared msys mbuf memory between
+            the Host and the Controller. Allocate the memory from the heap if
+            this option is sets, from the mempool otherwise.
+
     config BT_NIMBLE_TRANSPORT_ACL_FROM_LL_COUNT
         int "ACL Buffer count"
         depends on BT_NIMBLE_ENABLED
diff --git a/components/bt/porting/nimble/src/os_msys_init.c b/components/bt/porting/nimble/src/os_msys_init.c
index 53619197d0..bf4f414516 100644
--- a/components/bt/porting/nimble/src/os_msys_init.c
+++ b/components/bt/porting/nimble/src/os_msys_init.c
@@ -30,6 +30,11 @@ static STAILQ_HEAD(, os_mbuf_pool) g_msys_pool_list =
 
 #define OS_MSYS_1_SANITY_MIN_COUNT MYNEWT_VAL(MSYS_1_SANITY_MIN_COUNT)
 #define OS_MSYS_2_SANITY_MIN_COUNT MYNEWT_VAL(MSYS_2_SANITY_MIN_COUNT)
+#if CONFIG_BT_NIMBLE_MSYS_BUF_FROM_HEAP
+#define OS_MSYS_BLOCK_FROM_HEAP                 (1)
+#else
+#define OS_MSYS_BLOCK_FROM_HEAP                 (0)
+#endif // CONFIG_BT_NIMBLE_MSYS_BUF_FROM_HEAP
 #else
 #define OS_MSYS_1_BLOCK_COUNT CONFIG_BT_LE_MSYS_1_BLOCK_COUNT
 #define OS_MSYS_1_BLOCK_SIZE CONFIG_BT_LE_MSYS_1_BLOCK_SIZE
@@ -38,6 +43,12 @@ static STAILQ_HEAD(, os_mbuf_pool) g_msys_pool_list =
 
 #define OS_MSYS_1_SANITY_MIN_COUNT 0
 #define OS_MSYS_2_SANITY_MIN_COUNT 0
+
+#if CONFIG_BT_LE_MSYS_BUF_FROM_HEAP
+#define OS_MSYS_BLOCK_FROM_HEAP                 (1)
+#else
+#define OS_MSYS_BLOCK_FROM_HEAP                 (0)
+#endif // CONFIG_BT_LE_MSYS_BUF_FROM_HEAP
 #endif
 
 
@@ -71,7 +82,7 @@ static struct os_mempool os_msys_init_2_mempool;
 #endif
 
 #if CONFIG_BT_LE_MSYS_INIT_IN_CONTROLLER
-extern int  esp_ble_msys_init(uint16_t msys_size1, uint16_t msys_size2, uint16_t msys_cnt1, uint16_t msys_cnt2);
+extern int  esp_ble_msys_init(uint16_t msys_size1, uint16_t msys_size2, uint16_t msys_cnt1, uint16_t msys_cnt2, uint8_t from_heap);
 extern void esp_ble_msys_deinit(void);
 
 int os_msys_init(void)
@@ -79,7 +90,8 @@ int os_msys_init(void)
     return esp_ble_msys_init(SYSINIT_MSYS_1_MEMBLOCK_SIZE,
                              SYSINIT_MSYS_2_MEMBLOCK_SIZE,
                              OS_MSYS_1_BLOCK_COUNT,
-                             OS_MSYS_2_BLOCK_COUNT);
+                             OS_MSYS_2_BLOCK_COUNT,
+                             OS_MSYS_BLOCK_FROM_HEAP);
 }
 
 void os_msys_deinit(void)
diff --git a/components/esp_rom/esp32c2/ld/esp32c2.rom.ld b/components/esp_rom/esp32c2/ld/esp32c2.rom.ld
index 63b063ff5b..53a309e137 100644
--- a/components/esp_rom/esp32c2/ld/esp32c2.rom.ld
+++ b/components/esp_rom/esp32c2/ld/esp32c2.rom.ld
@@ -1035,9 +1035,7 @@ r_ble_ll_utils_csa2_prng = 0x400013b8;
 r_ble_ll_utils_remapped_channel = 0x400013bc;
 r_ble_ll_whitelist_add = 0x400013c0;
 r_ble_ll_whitelist_chg_allowed = 0x400013c4;
-r_ble_ll_whitelist_clear = 0x400013c8;
 r_ble_ll_whitelist_read_size = 0x400013cc;
-r_ble_ll_whitelist_rmv = 0x400013d0;
 r_ble_ll_write_rf_path_compensation = 0x400013d8;
 r_ble_lll_adv_aux_schedule = 0x400013e0;
 r_ble_lll_adv_aux_schedule_first = 0x400013e4;
@@ -1113,7 +1111,6 @@ r_ble_lll_conn_master_common_init = 0x40001530;
 r_ble_lll_conn_master_new = 0x40001534;
 r_ble_lll_conn_module_reset = 0x40001540;
 r_ble_lll_conn_pre_process = 0x40001548;
-r_ble_lll_conn_process_acked_pdu = 0x4000154c;
 r_ble_lll_conn_recv_ack = 0x40001554;
 r_ble_lll_conn_recv_valid_packet = 0x40001558;
 r_ble_lll_conn_reset_pending_sched = 0x4000155c;
@@ -1196,7 +1193,6 @@ r_ble_lll_scan_npl_store = 0x400016dc;
 r_ble_lll_scan_period_timer_cb = 0x400016e0;
 r_ble_lll_scan_process_adv_in_isr = 0x400016e4;
 r_ble_lll_scan_req_backoff = 0x400016ec;
-r_ble_lll_scan_restart = 0x400016f0;
 r_ble_lll_scan_sched_next_aux = 0x40001700;
 r_ble_lll_scan_sched_remove = 0x40001704;
 r_ble_lll_scan_start = 0x40001708;