Structural unknown HCI Command in Bluetooth LE logs

Question

I am inspecting the Bluetooth HCI snoop logs as part of debugging an application. For dissecting the logs/Bluetooth LE packets I'm using Wireshark.

I found that there is a recurring unknown command in my Bluetooth LE logs, right before setting scan parameters and after generating advertisement reports. The command is being sent from the host to the controller. The host is a Samsung Galaxy S5, and the controller chip is a Broadcom BCM4354 MIMO.

The unknown code is "0xfd57"

The controller answers with a command complete packet. I have tried to look for events that induce this command but I've yet to find any; I cannot manually trigger it.

Below are screenshots depicting the unknown code:

Dissection of the command packet

Command appearing before advertising parameters:

Does anyone know any approaches to finding out more about this command? Or has anyone encountered such a command before?

Answer 1

I found this in some obscure documentation:

Raw Report Mode The start byte 0xFD indicates a raw HID report. In the Bluetooth module, the start byte is stripped and the following bytes are sent without interpretation. The Raw HID report consists of a start byte, length, descriptor type (which defines the type of HID device), and data specified in scan codes or encoded values. The format of the data depends on the descriptor type. HID reports are sent one report at a time.