diff --git a/configs/sim/src/sim_bringup.c b/configs/sim/src/sim_bringup.c
index 1a80917c822..578207cdff2 100644
--- a/configs/sim/src/sim_bringup.c
+++ b/configs/sim/src/sim_bringup.c
@@ -259,14 +259,6 @@ int sim_bringup(void)
 #endif
 
 #ifdef CONFIG_WIRELESS_BLUETOOTH
-  /* Initialize the Bluetooth stack */
-
-  ret = bt_netdev_register();
-  if (ret < 0)
-    {
-      syslog(LOG_ERR, "ERROR: bt_netdev_register() failed: %d\n", ret);
-    }
-
 #ifdef CONFIG_BLUETOOTH_NULL
   /* Register the NULL Bluetooth network device */
 
@@ -276,6 +268,17 @@ int sim_bringup(void)
       syslog(LOG_ERR, "ERROR: btnull_register() failed: %d\n", ret);
     }
 #endif
+
+  /* Initialize the Bluetooth stack (This will fail if no device has been
+   * registered).
+   */
+
+  ret = bt_netdev_register();
+  if (ret < 0)
+    {
+      syslog(LOG_ERR, "ERROR: bt_netdev_register() failed: %d\n", ret);
+    }
+
 #endif
 
   UNUSED(ret);
diff --git a/drivers/wireless/bluetooth/bt_null.c b/drivers/wireless/bluetooth/bt_null.c
index e30e0e63377..512bd21bfeb 100644
--- a/drivers/wireless/bluetooth/bt_null.c
+++ b/drivers/wireless/bluetooth/bt_null.c
@@ -39,13 +39,22 @@
 
 #include <nuttx/wireless/bt_driver.h>
 
+#include <string.h>
+#include <assert.h>
+#include <debug.h>
+
+#include <nuttx/wireless/bt_hci.h>
+#include <nuttx/wireless/bt_null.h>
+
 /****************************************************************************
  * Private Function Prototypes
  ****************************************************************************/
 
-static int btnull_open(FAR const struct bt_driver_s *dev);
-static int btnull_send(FAR const struct bt_driver_s *dev,
-                       FAR struct bt_buf_s *buf);
+static void btnull_send_cmdcomplete(FAR const struct bt_driver_s *dev);
+
+static int  btnull_open(FAR const struct bt_driver_s *dev);
+static int  btnull_send(FAR const struct bt_driver_s *dev,
+                        FAR struct bt_buf_s *buf);
 
 /****************************************************************************
  * Private Data
@@ -62,10 +71,44 @@ static const struct bt_driver_s g_bt_null =
  * Private Functions
  ****************************************************************************/
 
+static void btnull_send_cmdcomplete(FAR const struct bt_driver_s *dev)
+{
+  FAR struct bt_buf_s *buf;
+
+  buf = bt_buf_alloc(BT_EVT, NULL, 0);
+  if (buf != NULL)
+    {
+      FAR struct bt_hci_evt_hdr_s hdr;
+
+      /* Minimal setup for the command complete event */
+
+      hdr.evt = BT_HCI_EVT_CMD_COMPLETE;
+      hdr.len = sizeof(struct bt_hci_evt_hdr_s);
+      memcpy(bt_buf_extend(buf, sizeof(struct bt_hci_evt_hdr_s)), &hdr,
+             sizeof(struct bt_hci_evt_hdr_s));
+
+      wlinfo("Send CMD complete event\n");
+
+      bt_hci_receive(buf);
+    }
+}
+
 static int btnull_send(FAR const struct bt_driver_s *dev,
                        FAR struct bt_buf_s *buf)
 {
-  return OK;
+  wlinfo("Bit buffer: length %d\n", (int)buf->len);
+
+  /* Is the Bluetooth stack waiting for an event? */
+
+  if (buf->type == BT_CMD)
+    {
+      FAR struct bt_hci_cmd_hdr_s *hdr = (FAR void *)buf->data;
+
+      wlinfo("CMD: %04x\n", hdr->opcode);
+      btnull_send_cmdcomplete(dev);
+    }
+
+  return buf->len;
 }
 
 static int btnull_open(FAR const struct bt_driver_s *dev)
diff --git a/include/nuttx/wireless/bt_driver.h b/include/nuttx/wireless/bt_driver.h
index 1501a0708fc..c2c60d5dd92 100644
--- a/include/nuttx/wireless/bt_driver.h
+++ b/include/nuttx/wireless/bt_driver.h
@@ -80,7 +80,7 @@ struct bt_driver_s
  *   IPv6 or AF_BLUETOOTH socket.
  *
  *   This function should be called only once from board bring-up logic
- *   before any Bluetooth devices are registered.
+ *   *AFTER* any Bluetooth devices have been registered.
  *
  * Input Parameters:
  *   None
diff --git a/wireless/bluetooth/bt_buf.c b/wireless/bluetooth/bt_buf.c
index 37bc2097951..ac3c7879850 100644
--- a/wireless/bluetooth/bt_buf.c
+++ b/wireless/bluetooth/bt_buf.c
@@ -322,6 +322,7 @@ FAR struct bt_buf_s *bt_buf_alloc(enum bt_buf_type_e type,
    * allocated buffer structure.
    */
 
+  memset(buf, 0, sizeof(struct bt_buf_s));
   buf->pool = pool;
   buf->ref  = 1;
   buf->type = type;
@@ -347,7 +348,6 @@ FAR struct bt_buf_s *bt_buf_alloc(enum bt_buf_type_e type,
        * available buffers.
        */
 
-      memset(buf, 0, sizeof(struct bt_buf_s));
       buf->frame = iob_alloc(false);
       if (!buf->frame)
         {
@@ -368,6 +368,7 @@ FAR struct bt_buf_s *bt_buf_alloc(enum bt_buf_type_e type,
 
   return buf;
 }
+
 /****************************************************************************
  * Name: bt_buf_release
  *
diff --git a/wireless/bluetooth/bt_hcicore.c b/wireless/bluetooth/bt_hcicore.c
index 6962e754100..d5b8c358f3c 100644
--- a/wireless/bluetooth/bt_hcicore.c
+++ b/wireless/bluetooth/bt_hcicore.c
@@ -221,7 +221,7 @@ static void hci_cmd_done(uint16_t opcode, uint8_t status,
 
   /* If the command was synchronous wake up bt_hci_cmd_send_sync() */
 
-  if (sent->u.hci.sync)
+  if (sent->u.hci.sync != NULL)
     {
       FAR sem_t *sem = sent->u.hci.sync;
 
@@ -871,7 +871,7 @@ static int hci_tx_kthread(int argc, FAR char *argv[])
 
       g_btdev.ncmd = 0;
 
-      wlinfo("Sending command %x (buf %p) to driver\n",
+      wlinfo("Sending command %04x buf %p to driver\n",
              buf->u.hci.opcode, buf);
 
       dev->send(dev, buf);
@@ -994,7 +994,7 @@ static void le_read_buffer_size_complete(FAR struct bt_buf_s *buf)
   g_btdev.le_pkts = rp->le_max_num;
 }
 
-static int hci_init(void)
+static int hci_initialize(void)
 {
   FAR struct bt_hci_cp_host_buffer_size_s *hbs;
   FAR struct bt_hci_cp_set_event_mask_s *ev;
@@ -1257,7 +1257,7 @@ int bt_initialize(void)
       return err;
     }
 
-  err = hci_init();
+  err = hci_initialize();
   if (err)
     {
       return err;
@@ -1452,7 +1452,7 @@ int bt_hci_cmd_send_sync(uint16_t opcode, FAR struct bt_buf_s *buf,
    * back the blocking semaphore.
    */
 
-  if (!buf)
+  if (buf == NULL)
     {
       buf = bt_hci_cmd_create(opcode, 0);
       if (!buf)
@@ -1486,7 +1486,7 @@ int bt_hci_cmd_send_sync(uint16_t opcode, FAR struct bt_buf_s *buf,
 
   if (ret >= 0)
     {
-      if (!buf->u.hci.sync)
+      if (buf->u.hci.sync == NULL)
         {
           ret = -EIO;
         }
diff --git a/wireless/bluetooth/bt_netdev.c b/wireless/bluetooth/bt_netdev.c
index 7f29c2cb598..05a303c6c9d 100644
--- a/wireless/bluetooth/bt_netdev.c
+++ b/wireless/bluetooth/bt_netdev.c
@@ -980,7 +980,7 @@ static int btnet_properties(FAR struct radio_driver_s *netdev,
  *   IPv6 or AF_BLUETOOTH socket.
  *
  *   This function should be called only once from board bring-up logic
- *   before any Bluetooth devices are registered.
+ *   *AFTER* any Bluetooth devices have been registered.
  *
  * Input Parameters:
  *   None
diff --git a/wireless/bluetooth/bt_queue.c b/wireless/bluetooth/bt_queue.c
index 66fd9902bd1..48eecc525ed 100644
--- a/wireless/bluetooth/bt_queue.c
+++ b/wireless/bluetooth/bt_queue.c
@@ -151,6 +151,7 @@ int bt_queue_receive(mqd_t mqd, FAR struct bt_buf_s **buf)
 
   /* Wait for the next message */
 
+  u.msg.buf = NULL;
   msgsize = nxmq_receive(mqd, u.msgbuf, BT_MSGSIZE, &priority);
   if (msgsize < 0)
     {
@@ -163,7 +164,7 @@ int bt_queue_receive(mqd_t mqd, FAR struct bt_buf_s **buf)
    */
 
   DEBUGASSERT(msgsize == sizeof(struct bt_bufmsg_s));
-  DEBUGASSERT(u.msg.buf->frame != NULL);
+  DEBUGASSERT(u.msg.buf != NULL && u.msg.buf->frame != NULL);
 
   /* Return the buffer */