Central device receives BLE_GATT_STATUS_ATTERR_INSUF_AUTHENTICATION in BLE_GATTC_EVT_WRITE_RSP with an OOB Passkey, How do I start bonding at this point?

Question

The Peripheral device works with iOS, Andriod and Win devices running a central node (SDK s140).

My Central node works fine when I disable bonding on the peripheral.

But when I try to create a central node to bond to it, I cannot seem to start the bonding process correctly.

I have started PM with:

m_sec_param.bond = SEC_PARAM_BOND; // true
m_sec_param.mitm = SEC_PARAM_MITM; // true
m_sec_param.lesc = SEC_PARAM_LESC; // true
m_sec_param.keypress = SEC_PARAM_KEYPRESS; false
m_sec_param.io_caps = SEC_PARAM_IO_CAPABILITIES; // BLE_GAP_IO_CAPS_DISPLAY_ONLY
m_sec_param.oob = SEC_PARAM_OOB; // false
m_sec_param.min_key_size = SEC_PARAM_MIN_KEY_SIZE; // 7
m_sec_param.max_key_size = SEC_PARAM_MAX_KEY_SIZE; // 16
m_sec_param.kdist_own.enc = 1;
m_sec_param.kdist_own.id = 1;
m_sec_param.kdist_peer.enc = 1;
m_sec_param.kdist_peer.id = 1;

My BLE Event handler currently has this code

case BLE_GATTC_EVT_WRITE_RSP:
if (!m_bond_started &&
( (p_ble_evt->evt.gattc_evt.gatt_status == BLE_GATT_STATUS_ATTERR_INSUF_ENCRYPTION)
|| (p_ble_evt->evt.gattc_evt.gatt_status == BLE_GATT_STATUS_ATTERR_INSUF_AUTHENTICATION))){
m_bond_started = true; // Ensure we only try bonding once

ble_opt_t static_pin_option;
static_pin_option.gap_opt.passkey.p_passkey = m_passkey; // Set the OOB passkey
err_code = sd_ble_opt_set(BLE_GAP_OPT_PASSKEY, &static_pin_option);
APP_ERROR_CHECK(err_code); // NO error here

printf("...GAP Request authentication...\r\n");
#if 1
err_code = sd_ble_gap_authenticate(p_ble_evt->evt.gattc_evt.conn_handle, &m_sec_param);
//err_code = pm_conn_secure(p_ble_evt->evt.gattc_evt.conn_handle, false);
if (err_code != NRF_ERROR_BUSY) {
APP_ERROR_CHECK(err_code); // No error here
}
#else
// Also fails...
pm_handler_secure_on_error(p_ble_evt);
#endif
}

break;

The char that was written to produce the error is set to SEC_JUST_WORKS on the remote.

Which reports the ATT error 0x105 indicating insufficient Authentification...

I get this log on the Central:

Initializing...
Discovery Init'd...
CLS Initialized...
HTS Initialized...
DIS Initialized...
BAS Initialized...
... Starting scan (3)...
... Starting scan (1)...
... BLE CLS Master started ...
<info> app_timer: RTC: initialized.
<info> app: BLE CLS Master started.
<info> app: Erase bonds!
<info> peer_manager_handler: All peers deleted.
...MN-scan key 3233 3435 3637...
<info> app: MN-Scan filter matched
...SCAN - Connected ...

BLE - Connected.
<info> app: Connecting to target 9CFD15589CC8
<info> app: GATT ATT MTU on connection 0x0 changed to 185.
<info> app: Data length for connection 0x0 updated to 189.
CLS discovered...
HTS discovered...
DIS discovered...
BAS discovered...
<info> ble_hts_c: HTS Type discovered at peer.
...GAP Request authentication...
<info> app: GATTC Write rsp (x10) Error: x105.
<info> app: GATTC Write rsp (x14) Error: x105.
...PM - Security Params...
<error> peer_manager_sm: Could not perform security procedure. smd_params_reply() or smd_link_secure() returned NRF_ERROR_INVALID_ADDR. conn_handle: 0
<error> peer_manager_handler: Unexpected fatal error occurred: error: NRF_ERROR_INVALID_ADDR
<error> peer_manager_handler: Asserting.

ERROR 16 [NRF_ERROR_INVALID_ADDR] at D:/Nordic_SDKs/nRF5_SDK/components/ble/peer_manager/peer_manager_handler.c:294
<error>