If I create an RBF transaction using the Qt GUI but specify my own custom change address, bumpfee doesn't work because it claims it can't find the change address:

"Transaction does not have a change output"

This is because none of the outputs satisfy

pWallet->IsChange(...)

I see there's a "TODO" commented in CWallet::IsChange() in src/wallet/wallet.cpp:

// TODO: fix handling of 'change' outputs. The assumption is that any
// payment to a script that is ours, but is not in the address book
// is change.

I tend to put all my addresses in the address book whether I'm going to use them as change or not. I guess if the wallet was capable of creating its own SegWit change addresses I'd stop using custom change addresses, but currently it always seems to send change to a legacy address if I don't manually specify a change address.