[RR Bluetooth] Strange Return Byte when Using hcitool to send HCI command

First of all it's a silly problem but I struggled in for few hours.

While using hcitool to issue command to bluetooth controller, I found the response bytes are strange since they are not conform with spec.

for HCI command packet format:

As I tried to test if the hcitool works, I send LE Rand Command:

sudo hcitool -i hci0 cmd 0x08 0x0018

The response I got is:

< HCI Command: ogf 0x08, ocf 0x0018, plen 0

> HCI Event: 0x0e plen 12

  01 18 20 00 5F CD 97 0D DB 36 C4 F5 

Bluetooth Event format is:

There is not doubt that the event code is 0x0e, which means Command Complete. Per spec below

Num_HCI_Command_Packet: 0x01

Command_OPcode: 0x18 0x20  <= strange here

The first byte (0x18) surely matches OCF of sending command which is LE Rand. However, the 0x20 is not the OGF(0x08) we send.

After digging deeper, I found OCF is actually 12 bits while OGF is only 6 bits. Thus, the OGF 0x08 'value' when sending in command turns out 0x20 of response of byte boundary: 0x08 == 0x20 >> 4