bt_gatt_attr_read_chrc: no characteristic for value

[HesselM]

When performing a bt_gatt_discover with BT_GATT_DISCOVER_CHARACTERISTIC, the read-callback in the user_data, sometimes shows the message:
bt_gatt.bt_gatt_attr_read_chrc: No value for characteristic at 0x<XXXX>

In bt_gatt_attr_read_chrc, the following tries to read the value-handle:

	/* BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part G] page 534:
	 * 3.3.2 Characteristic Value Declaration
	 * The Characteristic Value declaration contains the value of the
	 * characteristic. It is the first Attribute after the characteristic
	 * declaration. All characteristic definitions shall have a
	 * Characteristic Value declaration.
	 */
	next = bt_gatt_attr_next(attr);
	if (!next) {
		BT_WARN("No value for characteristic at 0x%04x", attr->handle);
		pdu.value_handle = 0x0000;
	} else {
		pdu.value_handle = sys_cpu_to_le16(next->handle);
	}

bt_gatt_attr_next(..) does some swapping(?) of the user_data and the attribute-parameters, which are two completely different structures: for a characteristic-discovery, the user_data of the attribute is a struct bt_gatt_chrc, whereas the attribute itself is a struct bt_gatt_attr.

With the value-declaration being the first attribute after the characteristic definition, I think that the value-handle can be computed alternatively as:

pdu.value_handle = sys_cpu_to_le16(attr->handle + 1);

I'm using the Zephyr source of commit 32ce219 and a PCA10056 dev-board.