diff --git a/src/gatt-database.c b/src/gatt-database.c
index 19f03c5..2c2526f 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -174,8 +174,7 @@
 	struct notify *pending;
 };
 
-typedef uint8_t (*btd_gatt_database_ccc_write_t) (struct bt_att *att,
-							uint16_t value,
+typedef uint8_t (*btd_gatt_database_ccc_write_t) (struct pending_op *op,
 							void *user_data);
 typedef void (*btd_gatt_database_destroy_t) (void *data);
 
@@ -308,7 +307,7 @@
 		return;
 
 	if (ccc_cb->callback)
-		ccc_cb->callback(NULL, 0, ccc_cb->user_data);
+		ccc_cb->callback(NULL, ccc_cb->user_data);
 }
 
 static void att_disconnected(int err, void *user_data)
@@ -861,6 +860,76 @@
 	gatt_db_attribute_read_result(attrib, id, ecode, value, len);
 }
 
+static struct btd_device *att_get_device(struct bt_att *att)
+{
+	GIOChannel *io = NULL;
+	GError *gerr = NULL;
+	bdaddr_t src, dst;
+	uint8_t dst_type;
+	struct btd_adapter *adapter;
+
+	io = g_io_channel_unix_new(bt_att_get_fd(att));
+	if (!io)
+		return NULL;
+
+	bt_io_get(io, &gerr, BT_IO_OPT_SOURCE_BDADDR, &src,
+					BT_IO_OPT_DEST_BDADDR, &dst,
+					BT_IO_OPT_DEST_TYPE, &dst_type,
+					BT_IO_OPT_INVALID);
+	if (gerr) {
+		error("bt_io_get: %s", gerr->message);
+		g_error_free(gerr);
+		g_io_channel_unref(io);
+		return NULL;
+	}
+
+	g_io_channel_unref(io);
+
+	adapter = adapter_find(&src);
+	if (!adapter) {
+		error("Unable to find adapter object");
+		return NULL;
+	}
+
+	return btd_adapter_find_device(adapter, &dst, dst_type);
+}
+
+static struct pending_op *pending_ccc_new(struct bt_att *att,
+					struct gatt_db_attribute *attrib,
+					uint16_t value,
+					uint8_t link_type)
+{
+	struct pending_op *op;
+	struct btd_device *device;
+
+	device = att_get_device(att);
+	if (!device) {
+		error("Unable to find device object");
+		return NULL;
+	}
+
+	op = new0(struct pending_op, 1);
+
+	op->data.iov_base = UINT_TO_PTR(value);
+	op->data.iov_len = sizeof(value);
+
+	op->device = device;
+	op->attrib = attrib;
+	op->link_type = link_type;
+
+	return op;
+}
+
+static void pending_op_free(void *data)
+{
+	struct pending_op *op = data;
+
+	if (op->owner_queue)
+		queue_remove(op->owner_queue, op);
+
+	free(op);
+}
+
 static void gatt_ccc_write_cb(struct gatt_db_attribute *attrib,
 					unsigned int id, uint16_t offset,
 					const uint8_t *value, size_t len,
@@ -904,9 +973,20 @@
 	if (ccc->value[0] == value[0] && ccc->value[1] == value[1])
 		goto done;
 
-	if (ccc_cb->callback)
-		ecode = ccc_cb->callback(att, get_le16(value),
-						ccc_cb->user_data);
+	if (ccc_cb->callback) {
+		struct pending_op *op;
+
+		op = pending_ccc_new(att, attrib, get_le16(value),
+					bt_att_get_link_type(att));
+		if (!op) {
+			ecode = BT_ATT_ERROR_UNLIKELY;
+			goto done;
+		}
+
+		ecode = ccc_cb->callback(op, ccc_cb->user_data);
+		if (ecode)
+			pending_op_free(op);
+	}
 
 	if (!ecode) {
 		ccc->value[0] = value[0];
@@ -1800,16 +1880,6 @@
 	gatt_db_attribute_read_result(op->attrib, op->id, ecode, value, len);
 }
 
-static void pending_op_free(void *data)
-{
-	struct pending_op *op = data;
-
-	if (op->owner_queue)
-		queue_remove(op->owner_queue, op);
-
-	free(op);
-}
-
 static struct pending_op *pending_read_new(struct btd_device *device,
 					struct queue *owner_queue,
 					struct gatt_db_attribute *attrib,
@@ -2162,7 +2232,8 @@
 
 static void acquire_notify_reply(DBusMessage *message, void *user_data)
 {
-	struct external_chrc *chrc = user_data;
+	struct pending_op *op = user_data;
+	struct external_chrc *chrc = (void *) op->data.iov_base;
 	DBusError err;
 	int fd;
 	uint16_t mtu;
@@ -2200,7 +2271,9 @@
 static void acquire_notify_setup(DBusMessageIter *iter, void *user_data)
 {
 	DBusMessageIter dict;
-	struct external_chrc *chrc = user_data;
+	struct pending_op *op = user_data;
+	struct bt_gatt_server *server;
+	uint16_t mtu;
 
 	dbus_message_iter_open_container(iter, DBUS_TYPE_ARRAY,
 					DBUS_DICT_ENTRY_BEGIN_CHAR_AS_STRING
@@ -2209,30 +2282,39 @@
 					DBUS_DICT_ENTRY_END_CHAR_AS_STRING,
 					&dict);
 
-	dict_append_entry(&dict, "MTU", DBUS_TYPE_UINT16, &chrc->mtu);
+	append_options(&dict, op);
+
+	server = btd_device_get_gatt_server(op->device);
+
+	mtu = bt_gatt_server_get_mtu(server);
+
+	dict_append_entry(&dict, "MTU", DBUS_TYPE_UINT16, &mtu);
 
 	dbus_message_iter_close_container(iter, &dict);
 }
 
-static uint8_t ccc_write_cb(struct bt_att *att, uint16_t value, void *user_data)
+static uint8_t ccc_write_cb(struct pending_op *op, void *user_data)
 {
 	struct external_chrc *chrc = user_data;
 	DBusMessageIter iter;
+	uint16_t value;
+
+	value = op ? PTR_TO_UINT(op->data.iov_base) : 0;
 
 	DBG("External CCC write received with value: 0x%04x", value);
 
 	/* Notifications/indications disabled */
 	if (!value) {
 		if (!chrc->ntfy_cnt)
-			return 0;
+			goto done;
 
 		if (__sync_sub_and_fetch(&chrc->ntfy_cnt, 1))
-			return 0;
+			goto done;
 
 		if (chrc->notify_io) {
 			io_destroy(chrc->notify_io);
 			chrc->notify_io = NULL;
-			return 0;
+			goto done;
 		}
 
 		/*
@@ -2241,13 +2323,12 @@
 		 */
 		g_dbus_proxy_method_call(chrc->proxy, "StopNotify", NULL,
 							NULL, NULL, NULL);
-		return 0;
+		goto done;
 	}
 
-	if (chrc->ntfy_cnt == UINT_MAX) {
+	if (chrc->ntfy_cnt == UINT_MAX)
 		/* Maximum number of per-device CCC descriptors configured */
 		return BT_ATT_ERROR_INSUFFICIENT_RESOURCES;
-	}
 
 	/* Don't support undefined CCC values yet */
 	if (value > 2 ||
@@ -2257,17 +2338,17 @@
 
 	if (chrc->notify_io) {
 		__sync_fetch_and_add(&chrc->ntfy_cnt, 1);
-		return 0;
+		goto done;
 	}
 
-	chrc->mtu = bt_att_get_mtu(att);
-
 	/* Make use of AcquireNotify if supported */
 	if (g_dbus_proxy_get_property(chrc->proxy, "NotifyAcquired", &iter)) {
+		op->data.iov_base = (void *) chrc;
+		op->data.iov_len = sizeof(chrc);
 		if (g_dbus_proxy_method_call(chrc->proxy, "AcquireNotify",
 						acquire_notify_setup,
 						acquire_notify_reply,
-						chrc, NULL))
+						op, pending_op_free))
 			return 0;
 	}
 
@@ -2281,6 +2362,10 @@
 
 	__sync_fetch_and_add(&chrc->ntfy_cnt, 1);
 
+done:
+	if (op)
+		pending_op_free(op);
+
 	return 0;
 }
 
@@ -2387,40 +2472,6 @@
 	return true;
 }
 
-static struct btd_device *att_get_device(struct bt_att *att)
-{
-	GIOChannel *io = NULL;
-	GError *gerr = NULL;
-	bdaddr_t src, dst;
-	uint8_t dst_type;
-	struct btd_adapter *adapter;
-
-	io = g_io_channel_unix_new(bt_att_get_fd(att));
-	if (!io)
-		return NULL;
-
-	bt_io_get(io, &gerr, BT_IO_OPT_SOURCE_BDADDR, &src,
-					BT_IO_OPT_DEST_BDADDR, &dst,
-					BT_IO_OPT_DEST_TYPE, &dst_type,
-					BT_IO_OPT_INVALID);
-	if (gerr) {
-		error("bt_io_get: %s", gerr->message);
-		g_error_free(gerr);
-		g_io_channel_unref(io);
-		return NULL;
-	}
-
-	g_io_channel_unref(io);
-
-	adapter = adapter_find(&src);
-	if (!adapter) {
-		error("Unable to find adapter object");
-		return NULL;
-	}
-
-	return btd_adapter_find_device(adapter, &dst, dst_type);
-}
-
 static void desc_read_cb(struct gatt_db_attribute *attrib,
 					unsigned int id, uint16_t offset,
 					uint8_t opcode, struct bt_att *att,