diff --git a/include/netpacket/bluetooth.h b/include/netpacket/bluetooth.h
index cdba4e0aa8..69dac017d0 100644
--- a/include/netpacket/bluetooth.h
+++ b/include/netpacket/bluetooth.h
@@ -54,9 +54,10 @@
 #define BT_ADDR_ANY   {0, 0, 0, 0, 0, 0}
 #define BT_ADDR_LOCAL {0, 0, 0, 0xff, 0xff, 0xff}
 
-/* Any channel */
+/* Any channel, any PSM */
 
 #define BT_CHANNEL_ANY 0
+#define BT_PSM_ANY     0
 
 /* Socket protocols.
  *
diff --git a/include/nuttx/wireless/bt_ioctl.h b/include/nuttx/wireless/bt_ioctl.h
index b18cb55def..326f510a1d 100644
--- a/include/nuttx/wireless/bt_ioctl.h
+++ b/include/nuttx/wireless/bt_ioctl.h
@@ -62,6 +62,7 @@
 #  error Incorrect setting for number of Bluetooth IOCTL commands
 #endif
 
+/* NetBSD IOCTL commands ****************************************************/
 /* All of the following use an argument of type struct btreg_s:
  *
  * SIOCGBTINFO
@@ -102,6 +103,7 @@
 #define SIOCGBTSTATS           _WLIOC(WL_BLUETOOTHFIRST + 7)
 #define SIOCZBTSTATS           _WLIOC(WL_BLUETOOTHFIRST + 8)
 
+/* NuttX-specific IOCTL commands. *******************************************/
 /* SIOCBT_ADVERTISESTART
  *   Description:   Set advertisement data, scan response data,
  *                  advertisement parameters and start advertising.
@@ -148,6 +150,7 @@
 
 #define SIOCBT_SCANSTOP        _WLIOC(WL_BLUETOOTHFIRST + 13)
 
+/* Definitions associated with struct btreg_s *******************************/
 /* struct btreq_s union field accessors */
 
 #define btr_flags              btru.btri.btri_flags
@@ -168,17 +171,17 @@
 
 /* btr_flags */
 
-#define BTF_UP                 (1 << 0)  /* unit is up */
-#define BTF_RUNNING            (1 << 1)  /* unit is running */
-#define BTF_XMIT_CMD           (1 << 2)  /* transmitting CMD packets */
-#define BTF_XMIT_ACL           (1 << 3)  /* transmitting ACL packets */
-#define BTF_XMIT_SCO           (1 << 4)  /* transmitting SCO packets */
-#define BTF_INIT_BDADDR        (1 << 5)  /* waiting for bdaddr */
-#define BTF_INIT_BUFFER_SIZE   (1 << 6)  /* waiting for buffer size */
-#define BTF_INIT_FEATURES      (1 << 7)  /* waiting for features */
-#define BTF_NOOP_ON_RESET      (1 << 8)  /* wait for No-op on reset */
-#define BTF_INIT_COMMANDS      (1 << 9)  /* waiting for supported commands */
-#define BTF_MASTER             (1 << 10) /* request Master role */
+#define BTF_UP                 (1 << 0)  /* Unit is up */
+#define BTF_RUNNING            (1 << 1)  /* Unit is running */
+#define BTF_XMIT_CMD           (1 << 2)  /* Transmitting CMD packets */
+#define BTF_XMIT_ACL           (1 << 3)  /* Transmitting ACL packets */
+#define BTF_XMIT_SCO           (1 << 4)  /* Transmitting SCO packets */
+#define BTF_INIT_BDADDR        (1 << 5)  /* Waiting for bdaddr */
+#define BTF_INIT_BUFFER_SIZE   (1 << 6)  /* Waiting for buffer size */
+#define BTF_INIT_FEATURES      (1 << 7)  /* Waiting for features */
+#define BTF_NOOP_ON_RESET      (1 << 8)  /* Wait for No-op on reset */
+#define BTF_INIT_COMMANDS      (1 << 9)  /* Waiting for supported commands */
+#define BTF_MASTER             (1 << 10) /* Request Master role */
 
 /****************************************************************************
  * Public Types
diff --git a/wireless/bluetooth/bt_conn.c b/wireless/bluetooth/bt_conn.c
index 125e70d35a..3ce0101e2c 100644
--- a/wireless/bluetooth/bt_conn.c
+++ b/wireless/bluetooth/bt_conn.c
@@ -964,8 +964,12 @@ FAR struct bt_conn_s *bt_conn_create_le(FAR const bt_addr_le_t *peer)
 {
   FAR struct bt_conn_s *conn;
 
+  /* First check if this connection exists and that it is in a proper
+   * state.
+   */
+
   conn = bt_conn_lookup_addr_le(peer);
-  if (conn)
+  if (conn != NULL)
     {
       switch (conn->state)
         {
@@ -980,6 +984,10 @@ FAR struct bt_conn_s *bt_conn_create_le(FAR const bt_addr_le_t *peer)
         }
     }
 
+  /* No.. the connection does not exist.  Create it assuming MASTER role
+   * and put it in the BT_CONNECT_SCAN state.
+   */
+
   conn = bt_conn_add(peer, BT_HCI_ROLE_MASTER);
   if (!conn)
     {
diff --git a/wireless/bluetooth/bt_netdev.c b/wireless/bluetooth/bt_netdev.c
index c7550e6453..342ac2e17f 100644
--- a/wireless/bluetooth/bt_netdev.c
+++ b/wireless/bluetooth/bt_netdev.c
@@ -231,7 +231,8 @@ static int btnet_advertise(FAR struct net_driver_s *dev)
   dev->d_ipv6addr[0]  = HTONS(0xfe80);
   dev->d_ipv6addr[1]  = 0;
   dev->d_ipv6addr[2]  = 0;
-  dev->d_ipv6addr[3]  = 0x200;
+  dev->d_ipv6addr[3]  = 0;
+  dev->d_ipv6addr[4]  = HTONS(0x0200);
   dev->d_ipv6addr[5]  = (uint16_t)addr[0] << 8 | (uint16_t)addr[1];
   dev->d_ipv6addr[6]  = (uint16_t)addr[2] << 8 | (uint16_t)addr[3];
   dev->d_ipv6addr[7]  = (uint16_t)addr[4] << 8 | (uint16_t)addr[5];
@@ -888,6 +889,7 @@ static int btnet_req_data(FAR struct radio_driver_s *netdev,
   FAR struct bt_conn_s *conn;
   FAR struct bt_buf_s *buf;
   FAR struct iob_s *iob;
+  bt_addr_le_t peer;
 
   wlinfo("Received framelist\n");
   DEBUGASSERT(priv != NULL && meta != NULL && framelist != NULL);
@@ -898,10 +900,25 @@ static int btnet_req_data(FAR struct radio_driver_s *netdev,
   /* Create a connection structure for this peer if one does not already
    * exist.
    *
-   * REVISIT:  Can we do a handle lookup? Should we cache the last
-   * connection (since there is probably only one).  Either would be faster.
+   * Assumptions to REVISIT:
+   *
+   *   1. Role is Master (see bt_conn_create_le())
+   *   2. Address type is BT_ADDR_LE_PUBLIC (vs. BT_ADDR_LE_RANDOM)
    */
-#warning Missing logic
+
+  BLUETOOTH_ADDRCOPY(peer.val, btmeta->bm_raddr.val);
+  peer.type = BT_ADDR_LE_PUBLIC;
+
+  conn = bt_conn_create_le(&peer);
+  if (conn == NULL)
+    {
+      /* bt_conn_create_le() can fail if (1) the connection exists, but is
+       * in a bad state or (2) CONFIG_BLUETOOTH_MAX_CONN has been exceeded.
+       * Assume the latter.
+       */
+
+      return -ENOMEM;
+    }
 
   /* Add the incoming list of frames to the MAC's outgoing queue */