diff --git a/bluetooth/aidl/default/Android.bp b/bluetooth/aidl/default/Android.bp
index 3f4ba99..46a6983 100644
--- a/bluetooth/aidl/default/Android.bp
+++ b/bluetooth/aidl/default/Android.bp
@@ -20,13 +20,13 @@
     static_libs: [
         "android.hardware.bluetooth.async",
         "android.hardware.bluetooth.hci",
+        "libbluetooth_offload_hal",
     ],
 }
 
 cc_library_static {
     name: "libbluetoothhcihalimpl",
     vendor_available: true,
-    host_supported: true,
     defaults: ["android.hardware.bluetooth-service-build-defaults"],
     srcs: [
         "BluetoothHci.cpp",
@@ -57,28 +57,6 @@
     ],
 }
 
-cc_fuzz {
-    name: "android.hardware.bluetooth-service.default_fuzzer",
-    host_supported: true,
-    defaults: ["service_fuzzer_defaults"],
-    srcs: [
-        "test/fuzzer.cpp",
-    ],
-    static_libs: [
-        "android.hardware.bluetooth.async",
-        "android.hardware.bluetooth.hci",
-        "android.hardware.bluetooth-V1-ndk",
-        "libbluetoothhcihalimpl",
-        "liblog",
-    ],
-    fuzz_config: {
-        componentid: 27441,
-        cc: [
-            "mylesgw@google.com",
-        ],
-    },
-}
-
 filegroup {
     name: "manifest_android.hardware.bluetooth-service.default.xml",
     srcs: ["bluetooth-service-default.xml"],
diff --git a/bluetooth/aidl/default/BluetoothHci.cpp b/bluetooth/aidl/default/BluetoothHci.cpp
index a247cb0..5ac3afe 100644
--- a/bluetooth/aidl/default/BluetoothHci.cpp
+++ b/bluetooth/aidl/default/BluetoothHci.cpp
@@ -44,12 +44,10 @@
 
 using namespace ::android::hardware::bluetooth::hci;
 using namespace ::android::hardware::bluetooth::async;
-using aidl::android::hardware::bluetooth::Status;
+using aidl::android::hardware::bluetooth::hal::Status;
 
 namespace aidl::android::hardware::bluetooth::impl {
 
-void OnDeath(void* cookie);
-
 std::optional<std::string> GetSystemProperty(const std::string& property) {
   std::array<char, PROPERTY_VALUE_MAX> value_array{0};
   auto value_len = property_get(property.c_str(), value_array.data(), nullptr);
@@ -63,59 +61,10 @@
   return str.compare(0, prefix.length(), prefix) == 0;
 }
 
-class BluetoothDeathRecipient {
- public:
-  BluetoothDeathRecipient(BluetoothHci* hci) : mHci(hci) {}
-
-  void LinkToDeath(const std::shared_ptr<IBluetoothHciCallbacks>& cb) {
-    mCb = cb;
-    clientDeathRecipient_ = AIBinder_DeathRecipient_new(OnDeath);
-    auto linkToDeathReturnStatus = AIBinder_linkToDeath(
-        mCb->asBinder().get(), clientDeathRecipient_, this /* cookie */);
-    LOG_ALWAYS_FATAL_IF(linkToDeathReturnStatus != STATUS_OK,
-                        "Unable to link to death recipient");
-  }
-
-  void UnlinkToDeath(const std::shared_ptr<IBluetoothHciCallbacks>& cb) {
-    LOG_ALWAYS_FATAL_IF(cb != mCb, "Unable to unlink mismatched pointers");
-  }
-
-  void serviceDied() {
-    if (mCb != nullptr && !AIBinder_isAlive(mCb->asBinder().get())) {
-      ALOGE("Bluetooth remote service has died");
-    } else {
-      ALOGE("BluetoothDeathRecipient::serviceDied called but service not dead");
-      return;
-    }
-    {
-      std::lock_guard<std::mutex> guard(mHasDiedMutex);
-      has_died_ = true;
-    }
-    mHci->close();
-  }
-  BluetoothHci* mHci;
-  std::shared_ptr<IBluetoothHciCallbacks> mCb;
-  AIBinder_DeathRecipient* clientDeathRecipient_;
-  bool getHasDied() {
-    std::lock_guard<std::mutex> guard(mHasDiedMutex);
-    return has_died_;
-  }
-
- private:
-  std::mutex mHasDiedMutex;
-  bool has_died_{false};
-};
-
-void OnDeath(void* cookie) {
-  auto* death_recipient = static_cast<BluetoothDeathRecipient*>(cookie);
-  death_recipient->serviceDied();
-}
-
 BluetoothHci::BluetoothHci(const std::string& dev_path) {
   char property_bytes[PROPERTY_VALUE_MAX];
   property_get("vendor.ser.bt-uart", property_bytes, dev_path.c_str());
   mDevPath = std::string(property_bytes);
-  mDeathRecipient = std::make_shared<BluetoothDeathRecipient>(this);
 }
 
 int BluetoothHci::getFdFromDevPath() {
@@ -182,10 +131,7 @@
   mFdWatcher.WatchFdForNonBlockingReads(mFd,
                                         [this](int) { mH4->OnDataReady(); });
 
-  ndk::ScopedAStatus result = send(PacketType::COMMAND, reset);
-  if (!result.isOk()) {
-    ALOGE("Error sending reset command");
-  }
+  send(PacketType::COMMAND, reset);
   auto status = resetFuture.wait_for(std::chrono::seconds(1));
   mFdWatcher.StopWatchingFileDescriptors();
   if (status == std::future_status::ready) {
@@ -197,13 +143,13 @@
   resetPromise.reset();
 }
 
-ndk::ScopedAStatus BluetoothHci::initialize(
-    const std::shared_ptr<IBluetoothHciCallbacks>& cb) {
+void BluetoothHci::initialize(
+    const std::shared_ptr<hal::IBluetoothHciCallbacks>& cb) {
   ALOGI(__func__);
 
   if (cb == nullptr) {
     ALOGE("cb == nullptr! -> Unable to call initializationComplete(ERR)");
-    return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
+    abort();
   }
 
   HalState old_state = HalState::READY;
@@ -220,7 +166,6 @@
     ALOGE("initialize: Unexpected State %d", static_cast<int>(old_state));
     close();
     cb->initializationComplete(Status::ALREADY_INITIALIZED);
-    return ndk::ScopedAStatus::ok();
   }
 
   mCb = cb;
@@ -234,12 +179,9 @@
     if (mFd < 0) {
       mState = HalState::READY;
       cb->initializationComplete(Status::UNABLE_TO_OPEN_INTERFACE);
-      return ndk::ScopedAStatus::ok();
     }
   }
 
-  mDeathRecipient->LinkToDeath(mCb);
-
   // TODO: HCI Reset on emulators since the bluetooth controller
   // cannot be powered on/off during the HAL setup; and the stack
   // might received spurious packets/events during boottime.
@@ -283,20 +225,10 @@
     mState = HalState::ONE_CLIENT;
   }
   ALOGI("initialization complete");
-  auto status = mCb->initializationComplete(Status::SUCCESS);
-  if (!status.isOk()) {
-    if (!mDeathRecipient->getHasDied()) {
-      ALOGE("Error sending init callback, but no death notification");
-    }
-    close();
-    return ndk::ScopedAStatus::fromServiceSpecificError(
-        STATUS_FAILED_TRANSACTION);
-  }
-
-  return ndk::ScopedAStatus::ok();
+  mCb->initializationComplete(Status::SUCCESS);
 }
 
-ndk::ScopedAStatus BluetoothHci::close() {
+void BluetoothHci::close() {
   ALOGI(__func__);
   {
     std::lock_guard<std::mutex> guard(mStateMutex);
@@ -304,7 +236,6 @@
       LOG_ALWAYS_FATAL_IF(mState == HalState::INITIALIZING,
                           "mState is INITIALIZING");
       ALOGI("Already closed");
-      return ndk::ScopedAStatus::ok();
     }
     mState = HalState::CLOSING;
   }
@@ -322,43 +253,42 @@
     mState = HalState::READY;
     mH4 = nullptr;
   }
-  return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus BluetoothHci::sendHciCommand(
-    const std::vector<uint8_t>& packet) {
+void BluetoothHci::clientDied() {
+  ALOGI(__func__);
+  close();
+}
+
+void BluetoothHci::sendHciCommand(const std::vector<uint8_t>& packet) {
   return send(PacketType::COMMAND, packet);
 }
 
-ndk::ScopedAStatus BluetoothHci::sendAclData(
-    const std::vector<uint8_t>& packet) {
+void BluetoothHci::sendAclData(const std::vector<uint8_t>& packet) {
   return send(PacketType::ACL_DATA, packet);
 }
 
-ndk::ScopedAStatus BluetoothHci::sendScoData(
-    const std::vector<uint8_t>& packet) {
+void BluetoothHci::sendScoData(const std::vector<uint8_t>& packet) {
   return send(PacketType::SCO_DATA, packet);
 }
 
-ndk::ScopedAStatus BluetoothHci::sendIsoData(
-    const std::vector<uint8_t>& packet) {
+void BluetoothHci::sendIsoData(const std::vector<uint8_t>& packet) {
   return send(PacketType::ISO_DATA, packet);
 }
 
-ndk::ScopedAStatus BluetoothHci::send(PacketType type,
-    const std::vector<uint8_t>& v) {
+void BluetoothHci::send(PacketType type, const std::vector<uint8_t>& v) {
   if (v.empty()) {
     ALOGE("Packet is empty, no data was found to be sent");
-    return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    abort();
   }
 
   std::lock_guard<std::mutex> guard(mStateMutex);
   if (mH4 == nullptr) {
-    return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+    ALOGE("Illegal State");
+    abort();
   }
 
   mH4->Send(type, v);
-  return ndk::ScopedAStatus::ok();
 }
 
 }  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/default/BluetoothHci.h b/bluetooth/aidl/default/BluetoothHci.h
index 477cc5c..5c31468 100644
--- a/bluetooth/aidl/default/BluetoothHci.h
+++ b/bluetooth/aidl/default/BluetoothHci.h
@@ -16,8 +16,7 @@
 
 #pragma once
 
-#include <aidl/android/hardware/bluetooth/BnBluetoothHci.h>
-#include <aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.h>
+#include <hal/ffi.h>
 
 #include <future>
 #include <string>
@@ -28,26 +27,25 @@
 
 namespace aidl::android::hardware::bluetooth::impl {
 
-class BluetoothDeathRecipient;
-
 // This Bluetooth HAL implementation connects with a serial port at dev_path_.
-class BluetoothHci : public BnBluetoothHci {
+class BluetoothHci : public hal::IBluetoothHci {
  public:
   BluetoothHci(const std::string& dev_path = "/dev/hvc5");
 
-  ndk::ScopedAStatus initialize(
-      const std::shared_ptr<IBluetoothHciCallbacks>& cb) override;
+  void initialize(
+      const std::shared_ptr<hal::IBluetoothHciCallbacks>& cb) override;
 
-  ndk::ScopedAStatus sendHciCommand(
-      const std::vector<uint8_t>& packet) override;
+  void sendHciCommand(const std::vector<uint8_t>& packet) override;
 
-  ndk::ScopedAStatus sendAclData(const std::vector<uint8_t>& packet) override;
+  void sendAclData(const std::vector<uint8_t>& packet) override;
 
-  ndk::ScopedAStatus sendScoData(const std::vector<uint8_t>& packet) override;
+  void sendScoData(const std::vector<uint8_t>& packet) override;
 
-  ndk::ScopedAStatus sendIsoData(const std::vector<uint8_t>& packet) override;
+  void sendIsoData(const std::vector<uint8_t>& packet) override;
 
-  ndk::ScopedAStatus close() override;
+  void close() override;
+
+  void clientDied() override;
 
   static void OnPacketReady();
 
@@ -55,20 +53,17 @@
 
  private:
   int mFd{-1};
-  std::shared_ptr<IBluetoothHciCallbacks> mCb = nullptr;
+  std::shared_ptr<hal::IBluetoothHciCallbacks> mCb = nullptr;
 
   std::shared_ptr<::android::hardware::bluetooth::hci::H4Protocol> mH4;
 
-  std::shared_ptr<BluetoothDeathRecipient> mDeathRecipient;
-
   std::string mDevPath;
 
   ::android::hardware::bluetooth::async::AsyncFdWatcher mFdWatcher;
 
   int getFdFromDevPath();
-  [[nodiscard]] ndk::ScopedAStatus send(
-      ::android::hardware::bluetooth::hci::PacketType type,
-      const std::vector<uint8_t>& packet);
+  void send(::android::hardware::bluetooth::hci::PacketType type,
+            const std::vector<uint8_t>& packet);
   std::unique_ptr<NetBluetoothMgmt> management_{};
 
   // Send a reset command and discard all packets until a reset is received.
diff --git a/bluetooth/aidl/default/service.cpp b/bluetooth/aidl/default/service.cpp
index ef4b884..9e1a22c 100644
--- a/bluetooth/aidl/default/service.cpp
+++ b/bluetooth/aidl/default/service.cpp
@@ -16,7 +16,6 @@
 
 #define LOG_TAG "aidl.android.hardware.bluetooth.service.default"
 
-#include <aidl/android/hardware/bluetooth/IBluetoothHci.h>
 #include <android/binder_manager.h>
 #include <android/binder_process.h>
 #include <hidl/HidlSupport.h>
@@ -24,6 +23,7 @@
 
 #include "BluetoothHci.h"
 
+using ::aidl::android::hardware::bluetooth::hal::IBluetoothHci_addService;
 using ::aidl::android::hardware::bluetooth::impl::BluetoothHci;
 using ::android::hardware::configureRpcThreadpool;
 using ::android::hardware::joinRpcThreadpool;
@@ -35,15 +35,7 @@
     return 1;
   }
 
-  std::shared_ptr<BluetoothHci> service =
-      ndk::SharedRefBase::make<BluetoothHci>();
-  std::string instance = std::string() + BluetoothHci::descriptor + "/default";
-  auto result =
-      AServiceManager_addService(service->asBinder().get(), instance.c_str());
-  if (result == STATUS_OK) {
-    ABinderProcess_joinThreadPool();
-  } else {
-    ALOGE("Could not register as a service!");
-  }
+  IBluetoothHci_addService(new BluetoothHci());
+  ABinderProcess_joinThreadPool();
   return 0;
 }
diff --git a/bluetooth/aidl/default/test/fuzzer.cpp b/bluetooth/aidl/default/test/fuzzer.cpp
deleted file mode 100644
index e7a1eef..0000000
--- a/bluetooth/aidl/default/test/fuzzer.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <fuzzbinder/libbinder_ndk_driver.h>
-#include <fuzzer/FuzzedDataProvider.h>
-
-#include "BluetoothHci.h"
-
-using aidl::android::hardware::bluetooth::impl::BluetoothHci;
-using android::fuzzService;
-using ndk::SharedRefBase;
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  auto service = SharedRefBase::make<BluetoothHci>();
-
-  fuzzService(service->asBinder().get(), FuzzedDataProvider(data, size));
-
-  return 0;
-}