If I create an RBF transaction using the Qt GUI but specify my own custom change address, bumpfee doesn't work because it claims it can't find the change address:

    "Transaction does not have a change output"

This is because none of the outputs satisfy

    pWallet->IsChange(...)

I see there's a "TODO" commented in `CWallet::IsChange()` in `src/wallet/wallet.cpp`:

    // TODO: fix handling of 'change' outputs. The assumption is that any
    // payment to a script that is ours, but is not in the address book
    // is change.

I tend to put all my addresses in the address book whether I'm going to use them as change or not. I guess if the wallet was capable of creating its own SegWit change addresses I'd stop using custom change addresses, but currently it always seems to send change to a legacy address if I don't manually specify a change address.
ExtractDestination(out.scriptPubKey, dest);
                std::string addr{EncodeDestination(dest)};
                if (addresses_without_amount.count(addr) > 0) {
                    out.nValue = per_output_without_amount;
                    if (!gave_remaining_to_first) {
                        out.nValue += remainder % addresses_without_amount.size();
                        gave_remaining_to_first = true;
                    }
                    if (IsDust(out, pwallet->chain().relayDustFee())) {
                        /
                        throw JSONRPCError(RPC_WALLET_INSUFFICIENT_FUNDS, "Dynamically assigned remainder results in dust output.");
                    }
                } else {
                    if (IsDust(out, pwallet->chain().relayDustFee())) {
                        /
                        throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Specified output amount to %s is below dust threshold.", addr));
                    }
                }
            }
            const bool lock_unspents{options.exists("lock_unspents") ? options["lock_unspents"].get_bool() : false};
            if (lock_unspents) {
                for (const CTxIn& txin : rawTx.vin) {
                    pwallet->LockCoin(txin.prevout);
                }
            }
            return FinishTransaction(pwallet, options, rawTx);
        }
    };
}
RPCHelpMan walletprocesspsbt()