Bugzilla: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=248015
Basically what it says. I needed this for some BLE experiments. Seems to work fine. The kernel ACL handling's debug output spams dmesg with "Connection does not exist" stuff, but the packets are copied to the raw hook before these checks, so the raw HCI application can safely ignore the kernel's ACL handling.
Disclaimer: I don't know what I'm doing :D if there's a different way to allow this, feel free to implement that.