Comment 37 for bug 1165433

I read it as destroying the tty structure before it was completely cleaned up, so future references to the tty struct were pointing to freed memory. Even better it looks like a new version of the patch set was released today Jul 26, in fact just now pretty much, subject "rfcomm: Implement rfcomm as a proper tty_port" where Gianluca writes:

"This patchset addresses an issue with the rfcomm tty driver in the
current stable kernels that manifests itself as a sudden lockup of the
whole machine or as a OOPS if we are lucky enough (I wasn't).

Triggering the problem is very easy:

1) establish a bluetooth connection with a bluetooth host
2) open the tty it provides with some program
3) turn off the bluetooth host or take it out of range"

which sounds very much like the problem we're seeing.