Decode MPEG 2,4 AAC-LC LATM bitstream for a2dp

I am trying to decode bitstream that I received from Apple IPhone for bluetooth A2DP profile.

According to Apple the structure should be

The sample bitstream I have is

36 00 47 00 | 80 60 00 01 00 06 3c ab 00 00 00 00 | 47 fc 00 00 b0 90 80 03 00 20 20 66 00 01 98 00 0d e1 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c

First four bytes are L2CAP, next 12 are AVDTP. But I am not able to decode rest of the bytes. Kindly help.

I have seen ISO 14496-3 that define AudioMuxElement but still I am not able to relate it to the bytes.

Recently, I've got very same problem. Since decoding bit-stream on a piece of paper is not very handy, I've created a simple decoder (for debugging purposes) based on ISO/IEC 14496-3 reference implementation.

Properly decoded stream from the question:

useSameStreamMux:1             = 0 => 0
audioMuxVersion:1              = 1 => 1
audioMuxVersionA:1             = 0 => 0
bytesForValue:2                = 00 => 0
valueTmp:8                     = 11111111 => 255 (taraBufferFullness)
allStreamsSameTimeFraming:1    = 1 => 1
numSubFrames:6                 = 000000 => 0
numProgram:4                   = 0000 => 0
numLayer:3                     = 000 => 0
bytesForValue:2                = 00 => 0
valueTmp:8                     = 00010110 => 22 (ascLen)
audioObjectType:5              = 00010 => 2
samplingFrequencyIndex:4       = 0100 => 4
channelConfiguration:4         = 0010 => 2
frameLengthFlag:1              = 0 => 0
dependsOnCoreCoder:1           = 0 => 0
extensionFlag:1                = 0 => 0
fillBits:6                     = 000000 => 0
frameLengthType:3              = 000 => 0
latmBufferFullness:8           = 11000000 => 192
otherDataPresent:1             = 0 => 0
crcCheckPresent:1              = 0 => 0
tmp:8                          = 00100000 => 32 (MuxSlotLengthBytes)
payload:8                      = 00100000 => 32
...
payload:8                      = 00011100 => 28
byteAlign:0                    = 0 => 0