I cloned the wireless UART example application and modified gAppUseBonding_d/gAppUsePairing_d/gAppUsePrivacy_d all to 1 in app_preinclude.h. The issue I observe is that the device advertises using the public address (00:04:9F:00:00:0A), rather than the private address. If I set gAdvParams.ownAddressType to gBleAddrTypeRandom_c in BleConnManager_GapDualRoleConfig, it uses the random address. Is this a known issue? The more confusing part is that documentation for ownAddressType states: "If BLE 4.2 Controller Privacy is enabled, this parameter is irrelevant as Private Resolvable Addresses are always used."
An additional related issue is that with all the settings as such, the RandomRxBdAddr is set to 1 in the advertising packet, in violation of the Bluetooth spec indicating that it is RFU and should be set to 0.
Using version 1.0.2 of the connectivity software.