Solved this, thanks Andy Shevchenko.
It appears on Edison (and some other BT devices too), bd_addr is not
stored in OTP. For instance on Edison it is stored in a partition on the
eMMC (/factory). The bcm driver (BCM43341B0) bases the default bd_addr
on the chip (43:34:1B:00:1F:AC), which is fine for most BT services, but
apparently not for pan/nap. It seems like the bnep device is created and
then immediately removed again. The only thing missing is error handling
of this case.
Using the bdaddr tool to set the address makes connman connect to
bluetooth service without problems.
Thanks for the feedback.
If I am not completely mistaken, 43:34:1B:00:1F:AC says it is locally
administered address, so you can't reach any routed network.