I'm wondering whether the value pointed to by "ble_gatts_hvx_params_t.p_len" passed to sd_ble_gatts_hvx is copied to SoftDevice-owned memory before the call returns NRF_SUCCESS.
I've seen in other posts that the data pointed to by "p_data" is maintained, but I haven't specifically seen the length mentioned.
I'm using nRF5 SDK 14.2 and SoftDevice s132 v5.1.0.