This was broken since 6c69b12000. The first byte in io_data buffer must be the BT H4 packet type. Without this change an assertion in bt_netdev.c:535 is always raised and nimble host layer crash.
6c69b12000