BLE protocol: GoPro responds with wrong settings (TLV)

[jampy]

I implemented the GoPro BLE protocol myself and for the most part of it it works fine.

However, when asking for certain status or settings, the camera response is not exactly what is asked for in the command.

Example 1:

• computer is sending 03 32 01 53 to the settings characteristic GP-0074 of the camera
  • that should be packet length (3 bytes), command (0x32 = Get Setting Capabilities), payload length (1) and setting id (0x53 = 83 = GPS)
• camera is responding with 08 32 00 53 01 00 53 01 01 via GP-0075
  • 0x08 is the length of the packet (general packet), maching the number of bytes received
  • 0x32 is the command the response is referring to (as expected)
  • 0x00 is the status (OK)
  • 0x53 is the requested setting (GPS)
  • 0x01 is the TLV payload length (for "GPS" in this case; as expected 1 byte)
  • 0x00 is the value
  • 0x53 is yet again the ID for the GPS setting!?
  • 0x01 is the TLV payload length (still, for "GPS")
  • 0x00 is the (different!) value

Why is the camera delivering two times the same setting, with contradicting values?

Example 2:

When sending 03 32 01 03 to GP-0073 to query setting "Frames Per Second" the camera responds with about 40 BLE characteristics notifications that combine to a huge GoPro command response of 257 bytes:

(each line is one BLE notification)
22 e2 32 00 02 00 05 00 06 00 0d 00 13 00 18 00 1e 00 1f 00
80 20 00 25 00 29 01 09 29 01 0c 2a 01 08 2b 01 00 2b 01 02
81 2b 01 03 2b 01 04 2c 01 09 2d 01 08 2f 01 07 2f 01 0c 36
82 01 00 36 01 01 3b 01 00 3b 01 01 3b 01 04 3b 01 06 3b 01
83 07 3e 04 00 03 d0 90 3e 04 00 06 1a 80 3e 04 00 09 27 c0
84 3e 04 00 0a ae 60 3e 04 00 0c 35 00 3e 04 00 0f 42 40 3e
85 04 00 12 4f 80 3e 04 00 18 6a 00 3e 04 00 1e 84 80 3e 04
86 00 24 9f 00 3e 04 00 26 25 a0 3e 04 00 3d 09 00 40 01 00
87 40 01 01 40 01 02 40 01 03 40 01 04 40 01 05 40 01 06 40
88 01 07 40 01 08 40 01 09 40 01 0a 40 01 0b 40 01 0c 4b 00
89 4c 00 53 01 00 53 01 01 54 01 00 54 01 01 54 01 02 54 01
8a 03 54 01 04 54 01 05 54 01 06 54 01 07 54 01 08 54 01 09
8b 54 01 0a 54 01 0b 56 01 00 56 01 01 5b 01 03 5b 01 64 66
8c 00 69 00 6f 00 70 01 64 70 01 65 70 01 66 70 01 67 70 01
8d 68 72 00 73 00 74 00 75 00 76 00 79 01 00 79 01 03 79 01
8e 04 79 01 09 79 01 0a 7a 00 7b 00 7d 00 7e 00 80 00 81 00
8f 82 00 83 00 84 00 86 01 00 86 01 01 87 00 8b 00 90 01 0c
80 90 01 0d 90 01 0f 90 01 10 90 01 12 90 01 13 90 01 14 90
81 01 15 90 01 18 90 01 1a 90 01 1d 90 01 1e 90 01 1f 90 01
82 20 91 00 92 00 93 00 99 00 9c 00 9d 00 a1 01 64 a1 01 65
83 a1 01 66 a1 01 c8 a4 00 a5 00 a6 00 a7 00 a8 00 ab 00 ac
84 00 af 01 00 af 01 01 b0 01 68 b0 01 69 b0 01 75 b0 01 7f
85 b2 01 00 b2 01 01 b3 00 b4 01 00 b4 01 6f b4 01 70 b6 00
86 b7 00 b8 00 ba 01 03 ba 01 04 bb 00 bd 01 02 bd 01 03 bd
87 01 04 bd 01 06 bd 01 07 bd 01 08 bd 01 09 bd 01 0a bd 01
88 64 c1 01 65 c1 01 67 c1 01 68 c3 01 00 c3 01 01 c6 00 c7
89 00 c8 00 c9 01 00 c9 01 01 c9 01 02 ca 00 cb 00 cd 01 00
8a cd 01 01 ce 00 cf 00 d0 00 d1 00 d2 00 d3 00 d4 00 d5 00
8b d6 00 d7 00 d8 01 46 d8 01 55 d8 01 64 d9 01 02 d9 01 03
8c d9 01 04 d9 01 06 d9 01 07 d9 01 08 d9 01 09 d9 01 0a d9
8d 01 64 da 00 db 01 01 db 01 02 db 01 03 db 01 04 dc 01 00
8e dc 01 01 dd 01 00 dd 01 01 de 01 00 de 01 01 df 01 00 df
8f 01 01 df 01 02 df 01 03 df 01 04 df 01 05 df 01 06 df 01
80 07 df 01 08 df 01 09 df 01 0a df 01 0b df 01 0c df 01 0d
81 df 01 0e e0 01 0a e0 01 14 e0 01 1e e0 01 28 e0 01 32 e0
82 01 3c e0 01 46 e0 01 50 e0 01 5a e0 01 64 e1 01 00 e1 01
83 01 e1 01 04 e1 01 06 e1 01 07 e2 01 00 e2 01 01 e3 00 e4
84 01 00 e4 01 01 e4 01 02 e4 01 03 e5 01 00 e5 01 03 e5 01
85 04 e5 01 09 e5 01 0a e6 00 e7 00 e8 00 e9 00 ea 00

At GoPro protocol low level this is valid (continuation packets and counter match), but why is the camera sending so much data?

I guess I'm doing something wrong, but I'm stuck...

Tested with two HERO13 Black cameras. The behaviour is consistent, I tested these payloads a lot of times.

Thanks for any help!