Bus Off occurs when the transmit error count raises above 255. Whenever a node fails to transmit a frame, it increases the error counter and when the counter increases beyond 255, the node gets in bus-off state and can not further participate on the bus.
Some situations which lead to Bus Off situation–
CAN_H / CAN_L line interrupted CAN_H shorted with CAN_L Incorrect Baud Rates at receiving and transmitting nodes.
An interesting article on Bus-Off - [LINK]
The article lists several bus failure modes which can be also be used to inject bus off.