Writing value to GATT characteristic via DBUS results in "garbage" value during subsequent read

Question

I'm attempting to write values to a GATT characteristic using DBUS, however when I read back the value of the characteristic, it's not the value that I just wrote.

For example, using the following code I'm attempting to write to a characteristic:

private void write (Cinder.Bluetooth.GattCharacteristic characteristic, uint8[] data) {
    var options = new GLib.HashTable<string, GLib.Variant> (str_hash, str_equal);
    options.insert ("type", new GLib.Variant ("s", "command"));
    options.insert ("link", new GLib.Variant ("s", "le"));
    try {
        characteristic.write_value (data, options);
    } catch (GLib.Error e) {
        warning (e.message);
    }
}

...

write (characteristic, new uint8[] {0xa8, 0x16});

If I use bluetoothctl to read back the value of the characteristic, I see:

[Ember Ceramic Mug:/service000c/char0011]# read
Attempting to read /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011
[Ember Ceramic Mug:/service000c/char0011]# [CHG] Attribute /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011 Value:
[Ember Ceramic Mug:/service000c/char0011]#   7c fd                                            |.

Even stranger, if I make the same write request multiple times, I continue to get different values after the subsequent reads:

[Ember Ceramic Mug:/service000c/char0011]# read
Attempting to read /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011
[Ember Ceramic Mug:/service000c/char0011]# [CHG] Attribute /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011 Value:
[Ember Ceramic Mug:/service000c/char0011]#   85 18

Using bluetoothctl for the writes, I see the exact behavior that I would expect:

[Ember Ceramic Mug:/service000c/char0011]# write "0xa8 0x16"
Attempting to write /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011
[Ember Ceramic Mug:/service000c/char0011]# read
Attempting to read /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011
[Ember Ceramic Mug:/service000c/char0011]# [CHG] Attribute /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011 Value:
[Ember Ceramic Mug:/service000c/char0011]#   a8 16                                            ..              
[Ember Ceramic Mug:/service000c/char0011]#   a8 16                                            ..              
[Ember Ceramic Mug:/service000c/char0011]# write "0x00 0x00"
Attempting to write /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011
[Ember Ceramic Mug:/service000c/char0011]# read
Attempting to read /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011
[Ember Ceramic Mug:/service000c/char0011]# [CHG] Attribute /org/bluez/hci0/dev_E3_A0_42_C6_94_F3/service000c/char0011 Value:
[Ember Ceramic Mug:/service000c/char0011]#   00 00                                            ..              
[Ember Ceramic Mug:/service000c/char0011]#   00 00                                            ..

In my write method, I've tried "request" and "reliable" for the type option, however the latter simply timed out as I suspect it's not supported. I also tried simply using an empty HashTable but saw the same results.

I also tried adding an extra \0 to the end of the data payload array in case there was a need for a null-terminator. And because I can never keep little vs. big endian straight in my head, yes, I tried flipping around the bytes in the array.

I've been able to pair and connect to devices, and read successfully from the characteristics in my code, so I'm pretty confident that my bindings are correct and that there must just be some little mistake with how I'm attempting to write.