diff --git a/system/bta/Android.bp b/system/bta/Android.bp
index 7e74c7e887f6958b26fa27fcf70445e2de01ec35..a0ec87968958a754e6ec79c38ffa8632da6d5e2a 100644
--- a/system/bta/Android.bp
+++ b/system/bta/Android.bp
@@ -40,7 +40,6 @@ filegroup {
     srcs: [
         "dm/bta_dm_act.cc",
         "dm/bta_dm_api.cc",
-        "dm/bta_dm_sec_api.cc",
         "dm/bta_dm_cfg.cc",
         "dm/bta_dm_ci.cc",
         "dm/bta_dm_disc.cc",
@@ -48,6 +47,7 @@ filegroup {
         "dm/bta_dm_main.cc",
         "dm/bta_dm_pm.cc",
         "dm/bta_dm_sec.cc",
+        "dm/bta_dm_sec_api.cc",
     ],
 }
 
@@ -184,6 +184,7 @@ cc_library_static {
         "jv/bta_jv_act.cc",
         "jv/bta_jv_api.cc",
         "jv/bta_jv_cfg.cc",
+        "rfcomm/bta_rfcomm_scn.cc",
         "sdp/bta_sdp.cc",
         "sdp/bta_sdp_act.cc",
         "sdp/bta_sdp_api.cc",
@@ -340,6 +341,7 @@ cc_test {
         ":TestCommonMainHandler",
         ":TestCommonMockFunctions",
         ":TestFakeOsi",
+        ":TestMockBtaScn",
         ":TestMockBtaSdp",
         ":TestMockBtif",
         ":TestMockDevice",
@@ -452,6 +454,70 @@ cc_test {
     cflags: ["-Wno-unused-parameter"],
 }
 
+cc_test {
+    name: "bt_host_test_bta_scn",
+    defaults: [
+        "bluetooth_gtest_x86_asan_workaround",
+        "fluoride_bta_defaults",
+        "mts_defaults",
+    ],
+    test_suites: ["device-tests"],
+    host_supported: true,
+    include_dirs: [
+        "packages/modules/Bluetooth/system",
+        "packages/modules/Bluetooth/system/gd",
+    ],
+    generated_headers: [
+        "BluetoothGeneratedDumpsysDataSchema_h",
+    ],
+    srcs: [
+        ":TestCommonMockFunctions",
+        ":TestFakeOsi",
+        ":TestMockBtaSys",
+        ":TestMockBtif",
+        ":TestMockStackBtm",
+        ":TestMockStackGap",
+        ":TestMockStackL2cap",
+        ":TestMockStackRfcomm",
+        ":TestMockStackSdp",
+        "jv/bta_jv_act.cc",
+        "rfcomm/bta_rfcomm_scn.cc",
+        "test/bta_rfcomm_scn_test.cc",
+    ],
+    shared_libs: [
+        "libbase",
+        "libcrypto",
+        "libcutils",
+        "liblog",
+    ],
+    static_libs: [
+        "libbluetooth-types",
+        "libbt-common",
+        "libbt-platform-protos-lite",
+        "libbt_shim_bridge",
+        "libbt_shim_ffi",
+        "libbtcore",
+        "libbtdevice",
+        "libchrome",
+        "libcom.android.sysprop.bluetooth",
+        "libevent",
+        "libgmock",
+    ],
+    sanitize: {
+        address: true,
+        cfi: true,
+        misc_undefined: ["bounds"],
+    },
+    target: {
+        android: {
+            whole_static_libs: [
+                "libPlatformProperties",
+            ],
+        },
+    },
+    cflags: ["-Wno-unused-parameter"],
+}
+
 // csis unit tests for host
 cc_test {
     name: "bluetooth_csis_test",
diff --git a/system/bta/BUILD.gn b/system/bta/BUILD.gn
index 7063354a69ebd2bb4b23f951780e2c605ab89de0..f641db787cc6e883eafa5678d8f0385443ccc991 100644
--- a/system/bta/BUILD.gn
+++ b/system/bta/BUILD.gn
@@ -113,6 +113,7 @@ static_library("bta") {
     "pan/bta_pan_api.cc",
     "pan/bta_pan_ci.cc",
     "pan/bta_pan_main.cc",
+    "rfcomm/bta_rfcomm_scn.cc",
     "sdp/bta_sdp.cc",
     "sdp/bta_sdp_act.cc",
     "sdp/bta_sdp_api.cc",
diff --git a/system/bta/ag/bta_ag_sdp.cc b/system/bta/ag/bta_ag_sdp.cc
index 3973798dff76f48240fdbd6cbda16f8346422b6f..9a0fe3e2bb2844ee09eb9cee91b8f7bbdf3475d0 100644
--- a/system/bta/ag/bta_ag_sdp.cc
+++ b/system/bta/ag/bta_ag_sdp.cc
@@ -30,6 +30,7 @@
 #include "bt_target.h"  // Legacy stack config
 #include "bt_trace.h"   // Legacy trace logging
 #include "bta/ag/bta_ag_int.h"
+#include "bta/include/bta_rfcomm_scn.h"
 #include "btif/include/btif_config.h"
 #include "device/include/interop.h"
 #include "device/include/interop_config.h"
@@ -257,7 +258,7 @@ void bta_ag_create_records(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
       if (bta_ag_cb.profile[i].sdp_handle == 0) {
         bta_ag_cb.profile[i].sdp_handle =
             get_legacy_stack_sdp_api()->handle.SDP_CreateRecord();
-        bta_ag_cb.profile[i].scn = BTM_AllocateSCN();
+        bta_ag_cb.profile[i].scn = BTA_AllocateSCN();
         bta_ag_add_record(bta_ag_uuid[i], data.api_register.p_name[i],
                           bta_ag_cb.profile[i].scn, data.api_register.features,
                           bta_ag_cb.profile[i].sdp_handle);
@@ -307,7 +308,7 @@ void bta_ag_del_records(tBTA_AG_SCB* p_scb) {
             bta_ag_cb.profile[i].sdp_handle);
         bta_ag_cb.profile[i].sdp_handle = 0;
       }
-      BTM_FreeSCN(bta_ag_cb.profile[i].scn);
+      BTA_FreeSCN(bta_ag_cb.profile[i].scn);
       bta_sys_remove_uuid(bta_ag_uuid[i]);
     }
   }
diff --git a/system/bta/hf_client/bta_hf_client_sdp.cc b/system/bta/hf_client/bta_hf_client_sdp.cc
index 97fc3a5c630ff2ed89189d1101adf816dc894633..5436a46e112ad1f36e3e390bfe3984bebed6a9ca 100644
--- a/system/bta/hf_client/bta_hf_client_sdp.cc
+++ b/system/bta/hf_client/bta_hf_client_sdp.cc
@@ -28,6 +28,7 @@
 
 #include "bta/hf_client/bta_hf_client_int.h"
 #include "bta/include/bta_hf_client_api.h"
+#include "bta/include/bta_rfcomm_scn.h"
 #include "bta/sys/bta_sys.h"
 #include "osi/include/allocator.h"
 #include "osi/include/osi.h"  // UNUSED_ATTR
@@ -182,7 +183,7 @@ void bta_hf_client_create_record(tBTA_HF_CLIENT_CB_ARR* client_cb_arr,
   if (client_cb_arr->sdp_handle == 0) {
     client_cb_arr->sdp_handle =
         get_legacy_stack_sdp_api()->handle.SDP_CreateRecord();
-    client_cb_arr->scn = BTM_AllocateSCN();
+    client_cb_arr->scn = BTA_AllocateSCN();
     bta_hf_client_add_record(p_service_name, client_cb_arr->scn,
                              client_cb_arr->features,
                              client_cb_arr->sdp_handle);
@@ -207,7 +208,7 @@ void bta_hf_client_del_record(tBTA_HF_CLIENT_CB_ARR* client_cb) {
   if (client_cb->sdp_handle != 0) {
     get_legacy_stack_sdp_api()->handle.SDP_DeleteRecord(client_cb->sdp_handle);
     client_cb->sdp_handle = 0;
-    BTM_FreeSCN(client_cb->scn);
+    BTA_FreeSCN(client_cb->scn);
     bta_sys_remove_uuid(UUID_SERVCLASS_HF_HANDSFREE);
   }
 }
diff --git a/system/stack/btm/btm_scn.h b/system/bta/include/bta_rfcomm_scn.h
similarity index 86%
rename from system/stack/btm/btm_scn.h
rename to system/bta/include/bta_rfcomm_scn.h
index 733173297b02536ef3cd14426b4c83ad502febf3..a43f3290f183553d371786f62feb94f48dbc61b8 100644
--- a/system/stack/btm/btm_scn.h
+++ b/system/bta/include/bta_rfcomm_scn.h
@@ -18,6 +18,6 @@
 
 #include <cstdint>
 
-uint8_t BTM_AllocateSCN(void);
-bool BTM_FreeSCN(uint8_t scn);
-bool BTM_TryAllocateSCN(uint8_t scn);
+uint8_t BTA_AllocateSCN(void);
+bool BTA_FreeSCN(uint8_t scn);
+bool BTA_TryAllocateSCN(uint8_t scn);
diff --git a/system/bta/jv/bta_jv_act.cc b/system/bta/jv/bta_jv_act.cc
index 73b9f1d46230807942bd8d68a9706c39b4500477..7d0d75f4d9eaa01ff89b4b7e632470a089269435 100644
--- a/system/bta/jv/bta_jv_act.cc
+++ b/system/bta/jv/bta_jv_act.cc
@@ -31,6 +31,7 @@
 
 #include "bt_target.h"  // Must be first to define build configuration
 #include "bta/include/bta_jv_co.h"
+#include "bta/include/bta_rfcomm_scn.h"
 #include "bta/jv/bta_jv_int.h"
 #include "bta/sys/bta_sys.h"
 #include "osi/include/allocator.h"
@@ -638,6 +639,8 @@ void bta_jv_enable(tBTA_JV_DM_CBACK* p_cback) {
   bta_jv.status = status;
   bta_jv_cb.p_dm_cback(BTA_JV_ENABLE_EVT, &bta_jv, 0);
   memset(bta_jv_cb.free_psm_list, 0, sizeof(bta_jv_cb.free_psm_list));
+  memset(bta_jv_cb.scn_in_use, 0, sizeof(bta_jv_cb.scn_in_use));
+  bta_jv_cb.scn_search_index = 1;
 }
 
 /** Disables the BT device manager free the resources used by java */
@@ -719,13 +722,13 @@ void bta_jv_get_channel_id(
     case BTA_JV_CONN_TYPE_RFCOMM: {
       uint8_t scn = 0;
       if (channel > 0) {
-        if (BTM_TryAllocateSCN(channel)) {
+        if (BTA_TryAllocateSCN(channel)) {
           scn = static_cast<uint8_t>(channel);
         } else {
           LOG_ERROR("rfc channel %u already in use or invalid", channel);
         }
       } else {
-        scn = BTM_AllocateSCN();
+        scn = BTA_AllocateSCN();
         if (scn == 0) {
           LOG_ERROR("out of rfc channels");
         }
@@ -766,7 +769,7 @@ void bta_jv_free_scn(int32_t type /* One of BTA_JV_CONN_TYPE_ */,
                      uint16_t scn) {
   switch (type) {
     case BTA_JV_CONN_TYPE_RFCOMM:
-      BTM_FreeSCN(scn);
+      BTA_FreeSCN(scn);
       break;
     case BTA_JV_CONN_TYPE_L2CAP:
       bta_jv_set_free_psm(scn);
diff --git a/system/bta/jv/bta_jv_int.h b/system/bta/jv/bta_jv_int.h
index 0c5900b1101cb6563d71ce3771ade75e52e86160..12a09a21f920eb20b75ad2e89f6101988a9a42a7 100644
--- a/system/bta/jv/bta_jv_int.h
+++ b/system/bta/jv/bta_jv_int.h
@@ -123,6 +123,9 @@ typedef struct {
   uint8_t sec_id[BTA_JV_NUM_SERVICE_ID];       /* service ID */
   uint16_t free_psm_list[BTA_JV_MAX_L2C_CONN]; /* PSMs freed by java
                                                 (can be reused) */
+  bool scn_in_use[RFCOMM_MAX_SCN];
+  uint8_t scn_search_index; /* used to search for free scns */
+
   uint8_t sdp_active;                          /* see BTA_JV_SDP_ACT_* */
   bluetooth::Uuid uuid;                   /* current uuid of sdp discovery*/
   tBTA_JV_PM_CB pm_cb[BTA_JV_PM_MAX_NUM]; /* PM on a per JV handle bases */
diff --git a/system/stack/btm/btm_scn.cc b/system/bta/rfcomm/bta_rfcomm_scn.cc
similarity index 72%
rename from system/stack/btm/btm_scn.cc
rename to system/bta/rfcomm/bta_rfcomm_scn.cc
index 5f76f13bed81536a645a269bdc4f226705b75e2f..3b0ba3d5c1241f0386cb173af62569a771353934 100644
--- a/system/stack/btm/btm_scn.cc
+++ b/system/bta/rfcomm/bta_rfcomm_scn.cc
@@ -14,13 +14,16 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "btm"
+#include "bta/include/bta_rfcomm_scn.h"
+
+#define LOG_TAG "bta"
 
 #include <cstdint>
-#include "stack/btm/btm_int_types.h"  // tBTM_CB
-#include "stack/include/rfcdefs.h"    // PORT_MAX_RFC_PORTS
 
-extern tBTM_CB btm_cb;
+#include "bta/jv/bta_jv_int.h"      // tBTA_JV_CB
+#include "stack/include/rfcdefs.h"  // RFCOMM_MAX_SCN
+
+extern tBTA_JV_CB bta_jv_cb;
 
 /*******************************************************************************
  *
@@ -31,30 +34,29 @@ extern tBTM_CB btm_cb;
  * Returns          Allocated SCN number or 0 if none.
  *
  ******************************************************************************/
-uint8_t BTM_AllocateSCN(void) {
-  BTM_TRACE_DEBUG("BTM_AllocateSCN");
-
+uint8_t BTA_AllocateSCN(void) {
+  LOG_DEBUG("BTA_AllocateSCN");
   // SCN can be allocated in the range of [1, RFCOMM_MAX_SCN]
   // btm_scn uses indexes 0 to RFCOMM_MAX_SCN-1 to track RFC ports
-  for (uint8_t i = btm_cb.btm_available_index; i < RFCOMM_MAX_SCN; ++i) {
-    if (!btm_cb.btm_scn[i]) {
-      btm_cb.btm_scn[i] = true;
-      btm_cb.btm_available_index = (i + 1);
+  for (uint8_t i = bta_jv_cb.scn_search_index; i < RFCOMM_MAX_SCN; ++i) {
+    if (!bta_jv_cb.scn_in_use[i]) {
+      bta_jv_cb.scn_in_use[i] = true;
+      bta_jv_cb.scn_search_index = (i + 1);
       return (i + 1);  // allocated scn is index + 1
     }
   }
 
   // In order to avoid OOB, btm_available_index must be no more than
   // RFCOMM_MAX_SCN.
-  btm_cb.btm_available_index =
-      std::min(btm_cb.btm_available_index, (uint8_t)(RFCOMM_MAX_SCN));
+  bta_jv_cb.scn_search_index =
+      std::min(bta_jv_cb.scn_search_index, (uint8_t)(RFCOMM_MAX_SCN));
 
   // Start from index 1 because index 0 (scn 1) is reserved for HFP
   // If there's no empty SCN from _last_index to BTM_MAX_SCN.
-  for (uint8_t i = 1; i < btm_cb.btm_available_index; ++i) {
-    if (!btm_cb.btm_scn[i]) {
-      btm_cb.btm_scn[i] = true;
-      btm_cb.btm_available_index = (i + 1);
+  for (uint8_t i = 1; i < bta_jv_cb.scn_search_index; ++i) {
+    if (!bta_jv_cb.scn_in_use[i]) {
+      bta_jv_cb.scn_in_use[i] = true;
+      bta_jv_cb.scn_search_index = (i + 1);
       return (i + 1);  // allocated scn is index + 1
     }
   }
@@ -72,15 +74,16 @@ uint8_t BTM_AllocateSCN(void) {
  *
  ******************************************************************************/
 
-bool BTM_TryAllocateSCN(uint8_t scn) {
+bool BTA_TryAllocateSCN(uint8_t scn) {
+  LOG_DEBUG("BTA_TryAllocateScn scn=%u", scn);
   /* Make sure we don't exceed max scn range.
    * Stack reserves scn 1 for HFP and HSP
    */
   if ((scn > RFCOMM_MAX_SCN) || (scn == 1) || (scn == 0)) return false;
 
   /* check if this scn is available */
-  if (!btm_cb.btm_scn[scn - 1]) {
-    btm_cb.btm_scn[scn - 1] = true;
+  if (!bta_jv_cb.scn_in_use[scn - 1]) {
+    bta_jv_cb.scn_in_use[scn - 1] = true;
     return true;
   }
 
@@ -96,13 +99,13 @@ bool BTM_TryAllocateSCN(uint8_t scn) {
  * Returns          true or false
  *
  ******************************************************************************/
-bool BTM_FreeSCN(uint8_t scn) {
-  BTM_TRACE_DEBUG("BTM_FreeSCN ");
+bool BTA_FreeSCN(uint8_t scn) {
+  LOG_DEBUG("BTA_FreeSCN scn=%u", scn);
   /* Since this isn't used by HFP, this function will only free valid SCNs
    * that aren't reserved for HFP, which is range [2, RFCOMM_MAX_SCN].
    */
   if (scn < RFCOMM_MAX_SCN && scn > 1) {
-    btm_cb.btm_scn[scn - 1] = false;
+    bta_jv_cb.scn_in_use[scn - 1] = false;
     return (true);
   } else {
     return (false); /* Illegal SCN passed in */
diff --git a/system/stack/test/btm/btm_scn_test.cc b/system/bta/test/bta_rfcomm_scn_test.cc
similarity index 50%
rename from system/stack/test/btm/btm_scn_test.cc
rename to system/bta/test/bta_rfcomm_scn_test.cc
index fbec2f612e4c288df67955dc3e67b2c569e21bb2..26e85ce9a6021cb5e83239cf8176fc1bf43629e2 100644
--- a/system/stack/test/btm/btm_scn_test.cc
+++ b/system/bta/test/bta_rfcomm_scn_test.cc
@@ -16,71 +16,67 @@
  *
  */
 
-#include "stack/btm/btm_scn.h"
+#include "bta_rfcomm_scn.h"
 
 #include <gtest/gtest.h>
 
-#include "stack/btm/btm_int_types.h"  // tBTM_CB
-#include "stack/include/rfcdefs.h"    // RFCOMM_MAX_SCN
-
-extern tBTM_CB btm_cb;
+#include "bta/jv/bta_jv_int.h"      // tBTA_JV_CB
+#include "stack/include/rfcdefs.h"  // RFCOMM_MAX_SCN
 
 using testing::Test;
 
-class BtmAllocateSCNTest : public Test {
+class BtaRfcommScnTest : public Test {
  public:
  protected:
   void SetUp() override {
-    btm_cb.btm_available_index = 1;
-    for (int i = 0; i < RFCOMM_MAX_SCN; i++) {
-      btm_cb.btm_scn[i] = false;
-    }
+    tBTA_JV_DM_CBACK* p_cback = [](tBTA_JV_EVT, tBTA_JV*, uint32_t) {};
+    bta_jv_enable(p_cback);
   }
 
   void TearDown() override {}
 };
 
-TEST_F(BtmAllocateSCNTest, scn_available_after_available_index) {
-  ASSERT_EQ(BTM_AllocateSCN(), 2);
-  ASSERT_EQ(BTM_AllocateSCN(), 3);
-  ASSERT_TRUE(BTM_TryAllocateSCN(4));
-  ASSERT_TRUE(BTM_TryAllocateSCN(5));
+TEST_F(BtaRfcommScnTest, scn_available_after_available_index) {
+  ASSERT_EQ(BTA_AllocateSCN(), 2);
+  ASSERT_EQ(BTA_AllocateSCN(), 3);
+  ASSERT_TRUE(BTA_TryAllocateSCN(4));
+  ASSERT_TRUE(BTA_TryAllocateSCN(5));
 
   // Available index should be 3, and the next available scn is 6
-  ASSERT_EQ(BTM_AllocateSCN(), 6);
+  ASSERT_EQ(BTA_AllocateSCN(), 6);
 }
 
-TEST_F(BtmAllocateSCNTest, scn_available_before_available_index) {
+TEST_F(BtaRfcommScnTest, scn_available_before_available_index) {
   for (uint8_t scn = 2; scn <= RFCOMM_MAX_SCN; scn++) {
-    ASSERT_TRUE(BTM_TryAllocateSCN(scn));
+    ASSERT_TRUE(BTA_TryAllocateSCN(scn));
   }
-  ASSERT_TRUE(BTM_FreeSCN(28));
-  ASSERT_EQ(BTM_AllocateSCN(), 28);
-  ASSERT_TRUE(BTM_FreeSCN(2));
+  ASSERT_TRUE(BTA_FreeSCN(28));
+  ASSERT_EQ(BTA_AllocateSCN(), 28);
+  ASSERT_TRUE(BTA_FreeSCN(2));
 
   // Available index is 27, and the available scn is 2
-  ASSERT_EQ(BTM_AllocateSCN(), 2);
+  ASSERT_EQ(BTA_AllocateSCN(), 2);
 }
 
-TEST_F(BtmAllocateSCNTest, can_allocate_all_scns) {
+TEST_F(BtaRfcommScnTest, can_allocate_all_scns) {
   for (uint8_t scn = 2; scn <= RFCOMM_MAX_SCN; scn++) {
-    ASSERT_EQ(BTM_AllocateSCN(), scn);
+    ASSERT_EQ(BTA_AllocateSCN(), scn);
   }
 }
 
-TEST_F(BtmAllocateSCNTest, only_last_scn_available) {
+TEST_F(BtaRfcommScnTest, only_last_scn_available) {
   // Fill all relevant SCN except the last
   for (uint8_t scn = 2; scn < RFCOMM_MAX_SCN; scn++) {
-    ASSERT_EQ(BTM_AllocateSCN(), scn);
+    ASSERT_EQ(BTA_AllocateSCN(), scn);
   }
 
-  ASSERT_EQ(BTM_AllocateSCN(), RFCOMM_MAX_SCN);
+  ASSERT_EQ(BTA_AllocateSCN(), RFCOMM_MAX_SCN);
 }
 
-TEST_F(BtmAllocateSCNTest, no_scn_available) {
+TEST_F(BtaRfcommScnTest, no_scn_available) {
   for (uint8_t scn = 2; scn <= RFCOMM_MAX_SCN; scn++) {
-    ASSERT_EQ(BTM_AllocateSCN(), scn);
+    ASSERT_EQ(BTA_AllocateSCN(), scn);
   }
 
-  ASSERT_EQ(BTM_AllocateSCN(), 0);
+  ASSERT_EQ(BTA_AllocateSCN(), 0);
 }
diff --git a/system/btif/Android.bp b/system/btif/Android.bp
index 61441672d1e699063d63e139d86382630a20e6fb..acaf572097288d9854be96b725a6747a0d556d8d 100644
--- a/system/btif/Android.bp
+++ b/system/btif/Android.bp
@@ -589,6 +589,7 @@ cc_test {
         ":TestMockBtaLeAudio",
         ":TestMockBtaLeAudioHalVerifier",
         ":TestMockBtaPan",
+        ":TestMockBtaScn",
         ":TestMockBtaSdp",
         ":TestMockBtaSys",
         ":TestMockBtaVc",
@@ -728,6 +729,7 @@ cc_test {
         ":TestMockBtaLeAudio",
         ":TestMockBtaLeAudioHalVerifier",
         ":TestMockBtaPan",
+        ":TestMockBtaScn",
         ":TestMockBtaSdp",
         ":TestMockBtaSys",
         ":TestMockBtaVc",
diff --git a/system/btif/src/btif_sock_rfc.cc b/system/btif/src/btif_sock_rfc.cc
index 3e526d8dd124e55eb7676c2042842898a4347ec8..8e797a0115059a13ace29c3269de8f3d84d8e7dd 100644
--- a/system/btif/src/btif_sock_rfc.cc
+++ b/system/btif/src/btif_sock_rfc.cc
@@ -22,12 +22,13 @@
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+
 #include <cstdint>
 #include <mutex>
 
 #include "bt_target.h"  // Must be first to define build configuration
-
 #include "bta/include/bta_jv_api.h"
+#include "bta/include/bta_rfcomm_scn.h"
 #include "btif/include/btif_metrics_logging.h"
 /* The JV interface can have only one user, hence we need to call a few
  * L2CAP functions from this file. */
@@ -410,7 +411,7 @@ static void free_rfc_slot_scn(rfc_slot_t* slot) {
     slot->rfc_handle = 0;
   }
 
-  if (slot->f.server) BTM_FreeSCN(slot->scn);
+  if (slot->f.server) BTA_FreeSCN(slot->scn);
   slot->scn = 0;
 }
 
diff --git a/system/main/shim/btm_api.h b/system/main/shim/btm_api.h
index 1b21726f3db1ce9c3d41dba88015956bcf02b148..1899c1b0af06f6480fd79d2751535b4f16af25a9 100644
--- a/system/main/shim/btm_api.h
+++ b/system/main/shim/btm_api.h
@@ -833,40 +833,6 @@ tBTM_STATUS BTM_RegisterForVSEvents(tBTM_VS_EVT_CB* p_cb, bool is_register);
 void BTM_VendorSpecificCommand(uint16_t opcode, uint8_t param_len,
                                uint8_t* p_param_buf, tBTM_VSC_CMPL_CB* p_cb);
 
-/*******************************************************************************
- *
- * Function         BTM_AllocateSCN
- *
- * Description      Look through the Server Channel Numbers for a free one to be
- *                  used with an RFCOMM connection.
- *
- * Returns          Allocated SCN number or 0 if none.
- *
- ******************************************************************************/
-uint8_t BTM_AllocateSCN(void);
-
-/*******************************************************************************
- *
- * Function         BTM_TryAllocateSCN
- *
- * Description      Try to allocate a fixed server channel
- *
- * Returns          Returns true if server channel was available
- *
- ******************************************************************************/
-bool BTM_TryAllocateSCN(uint8_t scn);
-
-/*******************************************************************************
- *
- * Function         BTM_FreeSCN
- *
- * Description      Free the specified SCN.
- *
- * Returns          true if successful, false if SCN is not in use or invalid
- *
- ******************************************************************************/
-bool BTM_FreeSCN(uint8_t scn);
-
 /*******************************************************************************
  *
  * Function         BTM_SetTraceLevel
diff --git a/system/stack/Android.bp b/system/stack/Android.bp
index 6d20246430154dc7cf2ec2b6467a70ca757d6d09..d2bb77e6ec5bfaed064fcbfd702b12f92b3b8ec8 100644
--- a/system/stack/Android.bp
+++ b/system/stack/Android.bp
@@ -254,7 +254,6 @@ cc_library_static {
         "btm/btm_iot_config.cc",
         "btm/btm_iso.cc",
         "btm/btm_main.cc",
-        "btm/btm_scn.cc",
         "btm/btm_sco.cc",
         "btm/btm_sco_hci.cc",
         "btm/btm_sco_hfp_hal.cc",
@@ -1537,7 +1536,6 @@ cc_test {
         "btm/btm_iot_config.cc",
         "btm/btm_iso.cc",
         "btm/btm_main.cc",
-        "btm/btm_scn.cc",
         "btm/btm_sco.cc",
         "btm/btm_sco_hci.cc",
         "btm/btm_sco_hfp_hal.cc",
@@ -1547,7 +1545,6 @@ cc_test {
         "btm/hfp_msbc_decoder.cc",
         "btm/hfp_msbc_encoder.cc",
         "metrics/stack_metrics_logging.cc",
-        "test/btm/btm_scn_test.cc",
         "test/btm/peer_packet_types_test.cc",
         "test/btm/sco_hci_test.cc",
         "test/btm/sco_pkt_status_test.cc",
diff --git a/system/stack/BUILD.gn b/system/stack/BUILD.gn
index 73ba8237726876569a9a73ccc4b2b8cd346ea83a..16f13683e18fee6abedf0f1b59b829e5ba80ef9e 100644
--- a/system/stack/BUILD.gn
+++ b/system/stack/BUILD.gn
@@ -121,7 +121,6 @@ source_set("stack") {
     "btm/btm_iot_config.cc",
     "btm/btm_iso.cc",
     "btm/btm_main.cc",
-    "btm/btm_scn.cc",
     "btm/btm_sco.cc",
     "btm/btm_sco_hci.cc",
     "btm/btm_sco_hfp_hal_linux.cc",
diff --git a/system/stack/btm/btm_int_types.h b/system/stack/btm/btm_int_types.h
index b5bd9ceb5c37f6a5382ba075df150bcd394d88b7..abfc07edd32e07d0240d09dffee89e74fae66bd8 100644
--- a/system/stack/btm/btm_int_types.h
+++ b/system/stack/btm/btm_int_types.h
@@ -228,15 +228,15 @@ typedef struct tBTM_CB {
                                            Octet16* p_stk);
   friend void btm_ble_ltk_request_reply(const RawAddress& bda, bool use_stk,
                                         const Octet16& stk);
-  uint16_t enc_handle{0};
+  [[maybe_unused]] uint16_t enc_handle{0};
 
   friend void btm_ble_ltk_request(uint16_t handle, uint8_t rand[8],
                                   uint16_t ediv);
   BT_OCTET8 enc_rand; /* received rand value from LTK request*/
 
-  uint16_t ediv{0}; /* received ediv value from LTK request */
+  [[maybe_unused]] uint16_t ediv{0}; /* received ediv value from LTK request */
 
-  uint8_t key_size{0};
+  [[maybe_unused]] uint8_t key_size{0};
 
  public:
   tBTM_BLE_VSC_CB cmn_ble_vsc_cb;
@@ -365,7 +365,6 @@ typedef struct tBTM_CB {
         kBtmLogHistoryBufferSize);
     CHECK(history_ != nullptr);
     history_->Push(std::string("Initialized btm history"));
-    btm_available_index = 1;
   }
 
   void Free() {
@@ -390,21 +389,6 @@ typedef struct tBTM_CB {
     alarm_free(execution_wait_timer);
     execution_wait_timer = nullptr;
   }
-
- private:
-  friend uint8_t BTM_AllocateSCN(void);
-  friend bool BTM_TryAllocateSCN(uint8_t scn);
-  friend bool BTM_FreeSCN(uint8_t scn);
-  uint8_t btm_scn[RFCOMM_MAX_SCN];
-  uint8_t btm_available_index;
-
-  // give access to private method for test:
-  friend class BtmAllocateSCNTest;
-  FRIEND_TEST(BtmAllocateSCNTest, can_allocate_all_scns);
-  FRIEND_TEST(BtmAllocateSCNTest, only_last_scn_available);
-  FRIEND_TEST(BtmAllocateSCNTest, scn_available_after_available_index);
-  FRIEND_TEST(BtmAllocateSCNTest, scn_available_before_available_index);
-  FRIEND_TEST(BtmAllocateSCNTest, no_scn_available);
 } tBTM_CB;
 
 /* security action for L2CAP COC channels */
diff --git a/system/stack/include/btm_api.h b/system/stack/include/btm_api.h
index 1ece0fd8c3d5963070a7ad66c180a68ee2779224..58ca81775960898522ede42ea8bae5f50d9189e9 100644
--- a/system/stack/include/btm_api.h
+++ b/system/stack/include/btm_api.h
@@ -155,40 +155,6 @@ tBTM_STATUS BTM_RegisterForVSEvents(tBTM_VS_EVT_CB* p_cb, bool is_register);
 void BTM_VendorSpecificCommand(uint16_t opcode, uint8_t param_len,
                                uint8_t* p_param_buf, tBTM_VSC_CMPL_CB* p_cb);
 
-/*******************************************************************************
- *
- * Function         BTM_AllocateSCN
- *
- * Description      Look through the Server Channel Numbers for a free one to be
- *                  used with an RFCOMM connection.
- *
- * Returns          Allocated SCN number or 0 if none.
- *
- ******************************************************************************/
-uint8_t BTM_AllocateSCN(void);
-
-/*******************************************************************************
- *
- * Function         BTM_TryAllocateSCN
- *
- * Description      Try to allocate a fixed server channel
- *
- * Returns          Returns true if server channel was available
- *
- ******************************************************************************/
-bool BTM_TryAllocateSCN(uint8_t scn);
-
-/*******************************************************************************
- *
- * Function         BTM_FreeSCN
- *
- * Description      Free the specified SCN.
- *
- * Returns          true if successful, false if SCN is not in use or invalid
- *
- ******************************************************************************/
-bool BTM_FreeSCN(uint8_t scn);
-
 /*******************************************************************************
  *
  * Function         BTM_SetTraceLevel
diff --git a/system/test/Android.bp b/system/test/Android.bp
index b10e2885c0e36eddf8c9f57abb8d441eefead891..6fca74160930b9f8f82da76b941badd306926d0c 100644
--- a/system/test/Android.bp
+++ b/system/test/Android.bp
@@ -129,6 +129,13 @@ filegroup {
     ],
 }
 
+filegroup {
+    name: "TestMockBtaScn",
+    srcs: [
+        "mock/mock_bta_scn.cc",
+    ],
+}
+
 filegroup {
     name: "TestMockBtaSdp",
     srcs: [
diff --git a/system/test/mock/mock_stack_btm_scn.cc b/system/test/mock/mock_bta_scn.cc
similarity index 83%
rename from system/test/mock/mock_stack_btm_scn.cc
rename to system/test/mock/mock_bta_scn.cc
index 1b58bd453dae6091925587dc9a55cfabc17fdcdc..e376bdc49f2a4fc81e56440988d14ea153dd27f8 100644
--- a/system/test/mock/mock_stack_btm_scn.cc
+++ b/system/test/mock/mock_bta_scn.cc
@@ -21,18 +21,19 @@
 
 #include <cstdint>
 
-#include "stack/btm/btm_int_types.h"
+#include "bta/include/bta_rfcomm_scn.h"
+#include "bta/jv/bta_jv_int.h"
 #include "test/common/mock_functions.h"
 
-bool BTM_FreeSCN(uint8_t scn) {
+bool BTA_FreeSCN(uint8_t scn) {
   inc_func_call_count(__func__);
   return false;
 }
-bool BTM_TryAllocateSCN(uint8_t scn) {
+bool BTA_TryAllocateSCN(uint8_t scn) {
   inc_func_call_count(__func__);
   return false;
 }
-uint8_t BTM_AllocateSCN(void) {
+uint8_t BTA_AllocateSCN(void) {
   inc_func_call_count(__func__);
   return 0;
 }