If I create an RBF transaction using the Qt GUI but specify my own custom change address, bumpfee doesn't work because it claims it can't find the change address:

    "Transaction does not have a change output"

This is because none of the outputs satisfy

    pWallet->IsChange(...)

I see there's a "TODO" commented in `CWallet::IsChange()` in `src/wallet/wallet.cpp`:

    // TODO: fix handling of 'change' outputs. The assumption is that any
    // payment to a script that is ours, but is not in the address book
    // is change.

I tend to put all my addresses in the address book whether I'm going to use them as change or not. I guess if the wallet was capable of creating its own SegWit change addresses I'd stop using custom change addresses, but currently it always seems to send change to a legacy address if I don't manually specify a change address.
[&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue
{
    const std::shared_ptr<const CWallet> pwallet = GetWalletForJSONRPCRequest(request);
    if (!pwallet) return UniValue::VNULL;
    CMutableTransaction mtx;
    if (!DecodeHexTx(mtx, request.params[0].get_str())) {
        throw JSONRPCError(RPC_DESERIALIZATION_ERROR, "TX decode failed. Make sure the tx has at least one input.");
    }
    
    LOCK(pwallet->cs_wallet);
    EnsureWalletIsUnlocked(*pwallet);
    
    std::map<COutPoint, Coin> coins;
    for (const CTxIn& txin : mtx.vin) {
        coins[txin.prevout]; 
    }
    pwallet->chain().findCoins(coins);
    
    ParsePrevouts(request.params[1], nullptr, coins);
    int nHashType = ParseSighashString(request.params[2]);
    
    std::map<int, bilingual_str> input_errors;
    bool complete = pwallet->SignTransaction(mtx, coins, nHashType, input_errors);
    UniValue result(UniValue::VOBJ);
    SignTransactionResultToJSON(mtx, complete, coins, input_errors, result);
    return result;
},
    };
}
static std::vector<RPCArg> OutputsDoc()