What range of Bluetooth UUIDs can be used for vendor defined profiles?

Solution 1:

All of the 16-bit and 32-bit UUIDs above the base UUID that you show above are reserved for items in the spec (or future specs). So vendor apps are free to use any 128-bit UUID less than the base UUID. There is no reserved space for vendors to use 16-bit or 32-bit UUIDs.

Solution 2:

You can register 16-bit UUIDs with the Bluetooth SIG: https://www.bluetooth.org/en-us/Pages/LoginRestrictedAll/16-bit-UUIDs-member.aspx This is useful if you need to save the bytes (for space, energy or other performance reasons).

My interpretation of the Bluetooth spec is that you can use any 128-bit UUID outside of Bluetooth UUID Base "range", freely:

 xxxxxxxx-0000-1000-8000-00805F9B34FB

I've put range in quotation marks, because the spec's 16-bit to 128-bit conversion formula that you quoted, suggests that the left-most bytes are the most significant (big endian!). Note, that if you treat the UUID as a 128-bit integer, the Bluetooth UUID Base "range" is not a continuous range of values.