rtl_bt: rtl8852bu_fw.bin missing ROM v3 (eco 0x04) patch for RTL8852B 0bda:b853

# RTL8852B (0bda:b853, ROM version 3): rtl8852bu_fw.bin lacks the firmware
patch for this silicon revision → Bluetooth non-functional

## Summary

On a laptop with a Realtek RTL8852BE combo card, the Bluetooth USB function
(`0bda:b853`) never initializes: `hci0` is created but stays `DOWN` with
`BD_ADDR 00:00:00:00:00:00`, is not registered with the management
interface, and cannot be brought up (`HCIDEVUP` → `ENODATA`). The Wi-Fi
side (`rtw89_8852be`) works fine.

Root cause: the chip reports **ROM version 3**, but the shipped
`rtl_bt/rtl8852bu_fw.bin` only contains firmware patch subsections for
**eco 0x01 and 0x02** (ROM versions 0 and 1). `btrtl` selects the patch
subsection where `eco == rom_version + 1` (i.e. `eco 0x04` for this chip),
finds none, and the controller is left running on ROM firmware with no
valid address.

The correct firmware clearly exists on Realtek's side: their **January 2026
Windows driver** ships a firmware blob for this exact silicon (`chip_id
0x14` = 8852B). It simply has not been published to linux-firmware in the
`RTBTCore` format the Linux driver consumes.

## Hardware / environment

- USB device: `Bus 003 Device 003: ID 0bda:b853 Realtek Semiconductor Corp.
Bluetooth Radio`
- Combo card: RTL8852BE (Wi-Fi `10ec:b852`, works with `rtw89_8852be`)
- Kernel: `7.1.3-200.fc44.x86_64` (Fedora)
- linux-firmware: package `20260622`; also verified against upstream
`linux-firmware.git` HEAD — `rtl_bt/rtl8852bu_fw.bin` is byte-identical
(129733 bytes), last touched 2026-03
- BlueZ: 5.87
- Secure Boot: disabled

## Symptoms

```
$ hciconfig -a
hci0:   Type: Primary  Bus: USB
        BD Address: 00:00:00:00:00:00  ACL MTU: 0:0  SCO MTU: 0:0
        DOWN

$ bluetoothctl show
No default controller available

$ btmgmt info
Index list with 0 items

$ sudo hciconfig hci0 up
Can't init device hci0: No data available (61)
```

## dmesg (btrtl/btusb, dynamic debug enabled)

```
Bluetooth: hci0: RTL: examining hci_ver=0b hci_rev=000b lmp_ver=0b
lmp_subver=8852
Bluetooth: hci0: RTL: rom_version status=0 version=3
Bluetooth: hci0: RTL: btrtl_initialize: key id 0
Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_fw.bin
Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_config.bin
hci0: RTL: FW version 013525d6-0002c3f8
hci0: RTL: check op=0 len=1 data=14          # project/chip id 0x14 =
CHIP_ID_8852B
hci0: RTL: opcode 0x0001
hci0: RTL: subsec, eco 0x01, len 0001063d
hci0: RTL: subsec, eco 0x02, len 0000f445
hci0: RTL: opcode 0x0008
Bluetooth: hci0: Opcode 0xfcf0 failed: -16   # MSFT ext read, non-fatal
Bluetooth: hci0: AOSP extensions version v0.96
```

No parse error is printed; the controller silently ends up unconfigured
(zero BD_ADDR), so it never registers with mgmt and cannot be powered on.

## Root-cause analysis

The chip identifies as CHIP_ID_8852B (`0x14`), `lmp_subver=0x8852`,
`hci_rev=0x0b`, `rom_version=3`, `key_id=0`, so `btrtl` correctly selects
`rtl_bt/rtl8852bu_fw.bin`.

In `btrtl_parse_section()` (drivers/bluetooth/btrtl.c), a patch subsection
is used only when:

```c
if (common_subsec->eco != btrtl_dev->rom_version + 1)
    continue;
```

For `rom_version = 3` the driver needs a subsection with `eco == 0x04`.

Parsing the actual `RTBTCore`-v2 file `rtl8852bu_fw.bin` (both the shipped
and the upstream-HEAD copy) shows the patch section (`opcode 0x0001`)
contains only two subsections:

- `eco 0x01` (len 0x1063d)
- `eco 0x02` (len 0xf445)

There is **no `eco 0x04` subsection**, so no patch is applied for this
silicon revision. Result: the controller runs ROM firmware only, exposes
`BD_ADDR = 00:00:00:00:00:00`, and is unusable. (The `Opcode 0xfcf0 failed:
-16` line is an unrelated non-fatal MSFT-extension probe, not the firmware
download.)

## Evidence the firmware exists (Realtek Windows driver, Jan 2026)

A current Lenovo-distributed Realtek Bluetooth driver package contains,
under `Source/Realtek8852BE/`:

- `rtl8852b_mp_chip_new.dat` — dated **2026-01-15**, container magic
`BTNIC003`, internal `chip_id 0x14` (= 8852B). This is the firmware for
this exact chip.

The blob is packaged in Realtek's proprietary Windows `BTNIC003` container
(raw MCU-addressed patch data), **not** the `RTBTCore` format used by
`btrtl`, so it cannot be dropped into `/lib/firmware/rtl_bt/` as-is. In
other words, Realtek already has the ROM-v3 firmware; it just hasn't been
converted/published to linux-firmware.

## Request

Please publish an updated `rtl_bt/rtl8852bu_fw.bin` (and matching config if
needed) that includes the firmware patch subsection for **ROM version 3
(`eco 0x04`)** of the RTL8852B, so that the `0bda:b853` variant initializes
on Linux. The corresponding blob already ships in Realtek's January 2026
Windows driver.

Happy to test candidate firmware and provide any additional logs (full
`dmesg`, `devcoredump`, `hci` traces).