l2cap_send was passed the caller's `len` (expected response size) instead of
the actual array size. The get_feature array is only 2 bytes (transaction
header + report ID), so this read up to 62 bytes of uninitialized stack.
Use sizeof(get_feature) to send only the 2-byte GET_REPORT request.
