Kernel: Linux 4.9.84 armv7l on board
Bluez: 5.65
Peer: Android 12 & IOS 16.6
Application:

• Use btmgmt open bluetooth settings

btmgmt power off
btmgmt connectable on
btmgmt pairable on
btmgmt power on
btmgmt le on
btmgmt io-cap 0x3(set io capability as NoInputNoOutput)
btmgmt ssp on (use legacy mode)

btmgmt settings

• BT_SECURITY for the L2CAP socket has been set to low, and an encryption requirement has been applied to one characteristic.

btgatt-server settings

Process:
I didn’t manually create an agent with IO capability via bluetoothctl, but with the above operations, it seems like the protocol automatically creates an agent to handle pairing issues when I try to access the characteristic with the encryption requirement.
We can see the communication via btmon.
btmon data

Problem:
I faced the problem where the Peripheral (my board) confirmation failed during the confirm phase. For details, see the btmon message in the picture above.

Error Phase
ps : This picture from Core_v5.4 Vol3, Part H, pate 1618

Suspicion:
I’m not quite sure where the problem is located, but after reading the confirmation calculation formula, I suspect it might be due to the algorithm differences between my phone and my board or an address issue, as the other parameters seem to be the same.

Confirm value calculation
C1 formula
Function e

I have tried to connect to my virtual machine(ubuntu) via Bluetooth with the same BlueZ version and the same operations, and it worked! Therefore, I suspect the problem is located in the kernel configuration of my board