Bluetooth: L2CAP: Set NULL callback for PDUs

It was not being set, and thus if the user_data contained garbage from
before, then conn.c would attempt to call that garbage.

Static channels don't have this issue, as every "SDU" fits into one PDU.

Signed-off-by: Jonathan Rico <jonathan.rico@nordicsemi.no>
Co-authored-by: Huajiang Zheng <nxf88597@lsv051208.swis.nl-cdc01.nxp.com>

subsys/bluetooth/host/l2cap.c

@@ -938,14 +938,16 @@ struct net_buf *l2cap_data_pull(struct bt_conn *conn,
 		__maybe_unused struct net_buf *b = k_fifo_get(&lechan->tx_queue, K_NO_WAIT);
 
 		__ASSERT_NO_MSG(b == pdu);
+	}
 
-		if (L2CAP_LE_CID_IS_DYN(lechan->tx.cid)) {
-			LOG_DBG("adding `sdu_sent` callback");
-			/* No user callbacks for SDUs */
-			make_closure(pdu->user_data,
-				     l2cap_chan_sdu_sent,
-				     UINT_TO_POINTER(lechan->tx.cid));
-		}
+	if (L2CAP_LE_CID_IS_DYN(lechan->tx.cid)) {
+		bool sdu_end = last_frag && last_seg;
+
+		LOG_DBG("adding `sdu_sent` callback");
+		/* No user callbacks for SDUs */
+		make_closure(pdu->user_data,
+			     sdu_end ? l2cap_chan_sdu_sent : NULL,
+			     sdu_end ? UINT_TO_POINTER(lechan->tx.cid) : NULL);
 	}
 
 	if (last_frag) {