If the privacy feature is disabled, calling bt_conn_le_create will change the state to BT_CONN_CONNECTING_SCAN (since bt_dev.le.rl_size == 0) and then call bt_le_scan_update. However, the fact that we are trying to connect on the coded PHY is never relayed to bt_le_scan_update. btle_scan_update calls start_passive_scan which calls start_le_scan_ext but provides parameters for the 1M PHY instead of the coded PHY. Since we aren't scanning on the coded PHY we'll never see the device we are trying to connect to.
Additionally, start_passive_scan uses default parameters for scanning instead of the ones passed to bt_conn_le_create.
