miniuart-bt,krnbt=on broken on RPi4b

Start by reproducing the reported RPi4b configuration from config.txt with dtoverlay=miniuart-bt,krnbt=on and the specified core frequency settings, then compare it with the working hciattach method. Use the reported Bluetooth UART timeout and baudrate errors as the failure criteria; done requires identifying a kernel-side cause and a confirmed resolution.

With this appended on top of the stock config.txt:

dtoverlay=miniuart-bt,krnbt=on
core_freq_min=500
core_freq=500

Kernel outputs the following:

[    6.771162] Bluetooth: Core ver 2.22
[    6.771303] Bluetooth: HCI device and connection manager initialized
[    6.771332] Bluetooth: HCI socket layer initialized
[    6.771364] Bluetooth: L2CAP socket layer initialized
[    6.771431] Bluetooth: SCO socket layer initialized
[    6.785501] Bluetooth: HCI UART driver ver 2.3
[    6.785524] Bluetooth: HCI UART protocol H4 registered
[    6.785631] Bluetooth: HCI UART protocol Three-wire (H5) registered
[    6.786340] Bluetooth: HCI UART protocol Broadcom registered
[    9.113411] Bluetooth: hci0: command 0xfc18 tx timeout
[    9.736229] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    9.736250] Bluetooth: BNEP filters: protocol multicast
[    9.736279] Bluetooth: BNEP socket layer initialized
[   17.113329] Bluetooth: hci0: BCM: failed to write update baudrate (-110)
[   17.113347] Bluetooth: hci0: Failed to set baudrate
[   19.193319] Bluetooth: hci0: command 0x0c03 tx timeout
[   27.353338] Bluetooth: hci0: BCM: Reset failed (-110)
[   29.443304] Bluetooth: hci0: command 0xfc18 tx timeout
[   37.593349] Bluetooth: hci0: BCM: failed to write update baudrate (-110)
[   37.593367] Bluetooth: hci0: Failed to set baudrate
[   39.673334] Bluetooth: hci0: command 0x0c03 tx timeout
[   47.833333] Bluetooth: hci0: BCM: Reset failed (-110)

I've replicated this with the stock image's kernel, with 5.10.17-v7l+ and RPi OS 64bit. Note that using the hciattach method works fine, but something I can't use as it's currently being deprecated by bluez.

Rings any bells?