When using bt_gatt_discover with BT_GATT_DISCOVER_CHARACTERISTIC the
read callback would be set to bt_gatt_attr_read_chrc which would attempt
to access the next attribute which in this case would not be set since
the value attribute is no fetched by the discovery, the spec actually
omit the value handle saying it should always be the first attribute to
appear after the characteristic thus we can assume it to be handle + 1.
Fixes#12159
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
80bc21e03c