The Bluetooth Core Specification v5.1 (Vol 2, Part E, 7.7.19) details that the HCI_Number_Of_Completed_Packets event (p. 1182 of the Core 5.1 spec) contains a Number_of_Handles parameter described as: "The number of Connection_Handles and Num_HCI_Data_Packets parameters pairs contained in this event." This value is described to range from 0 to 255, and the size of these Connection_Handles and Num_HCI_Data_Packets is 2 octets each.
Therefore, in a situation where the Number_of_Handles is 255, this means that this event must contain 510 octets of Connection_Handles and 510 octets of Num_HCI_Data_Packets, for a total of 1021 octets, including the Number_of_Handles. However, an HCI Event packet can only have up to 255 octets of data excluding its header (Vol 2, Part E, 5.4.4).
Is this a mistake in the specified range for Number_of_Handles? Shouldn't it be from 0 to 63 instead, adding up to a maximum of 253 parameter octets for this event?