The problem is in the rtbt binary. The BT V4 and BT V2 pairing routines are completely different. I traced the rtbt binary with edb debugger and I could find the LMssp_LM_User_Confirmation_Request_Reply routine activated only with BT V4 devices. Eventually we could pair BT V4 devices with patched rtbt binary in order to pair BT V4 devices.
The problem is in the rtbt binary. The BT V4 and BT V2 pairing routines are completely different. I traced the rtbt binary with edb debugger and I could find the LMssp_LM_ User_Confirmati on_Request_ Reply routine activated only with BT V4 devices. Eventually we could pair BT V4 devices with patched rtbt binary in order to pair BT V4 devices.