1// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES8_InitialiseSecureChannel_01_Error_Invalid_Remote_Operation + TC_eUICC_ES8_InitialiseSecureChannel_02_Error_Invalid_SMDP_Signature + TC_eUICC_ES8_InitialiseSecureChannel_03_Error_Invalid_Transaction_Identifier + TC_eUICC_ES8_InitialiseSecureChannel_04_Error_Invalid_CRT_Values + TC_eUICC_ES8_InitialiseSecureChannel_05_Error_InitialiseSecureChannel_request_while_Secure_Channel_Session_is_ongoing (extracted verbatim)
2
3function TC_eUICC_ES8_InitialiseSecureChannel_01_Error_Invalid_Remote_Operation()
4{
5	
6	tracenamestr = "测试目的：执行InitialiseSecureChannel，remoteOpId为#INVALID_REMOTE_OP_ID";
7	curDis.TraceStart(sno++,tracenamestr);
8	
9	curDis.TestStepStart2(stno++,"复位；");
10	ResetCard();
11	
12	curDis.TestStepStart2(stno++,"读卡器向卡片发送Terminal Capability命令；");
13	TS_TERMINAL_CAPABILITY_cmd();
14	
15	curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
16	TS_MANAGE_CHANNEL_OPEN();
17	
18	curLogicChannel = 1;
19	
20	curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
21	TS_SELECT("Select ISD",ISD_R_AID,"9000");
22	
23	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
24	var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
25	Profile_load_procedure.ICCID = ICCID_OP_PROF1;
26	Profile_load_procedure.ES10b_GetEUICCInfo1();
27	
28	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
29	Profile_load_procedure.ES10b_GetEUICCChallenge();
30
31	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
32	ctxParamsForCommonAuthentication = "A13A800400000000A1288003050000810308000082030100008303010000840302000085030200008603090000870302010082080000000011111111";
33	Profile_load_procedure.serverAddress = TEST_DP_ADDRESS1;
34	Profile_load_procedure.ES10b_AuthenticateServer();
35	
36	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
37	Profile_load_procedure.ES10b_PrepareDownload();
38	
39	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
40	Profile_load_procedure.ES10b_GetEID();
41	
42	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage；--Invalid RemoteOpId");
43	Profile_load_procedure.hostId = "47534D4120534D2D5858";
44	Profile_load_procedure.isErrorTest=true;
45	Profile_load_procedure.remoteOpId ="08";
46	Profile_load_procedure.bppCommandId="00";
47	Profile_load_procedure.errorReason="05";
48	Profile_load_procedure.simaResponse = "";
49	Profile_load_procedure.ES10b_LoadBoundProfilePackage();
50	
51	var errorReason = Profile_load_procedure.profInstallationResult.profileInstallationResultData.finalResult.ErrorResult.errorReason;
52	curStrHandle.CheckData("05", errorReason, "errorReason");
53	
54	RecoverCard();
55}
56
57function TC_eUICC_ES8_InitialiseSecureChannel_02_Error_Invalid_SMDP_Signature()
58{
59			
60	tracenamestr = "测试目的：执行InitialiseSecureChannel，smdpSign为无效的SM-DP+签名";
61	curDis.TraceStart(sno++,tracenamestr);
62	
63	curDis.TestStepStart2(stno++,"复位；");
64	ResetCard();
65	
66	curDis.TestStepStart2(stno++,"读卡器向卡片发送Terminal Capability命令；");
67	TS_TERMINAL_CAPABILITY_cmd();
68	
69	curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
70	TS_MANAGE_CHANNEL_OPEN();
71	
72	curLogicChannel = 1;
73	
74	curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
75	TS_SELECT("Select ISD",ISD_R_AID,"9000");
76	
77	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
78	var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
79	Profile_load_procedure.ICCID = ICCID_OP_PROF1;
80	Profile_load_procedure.ES10b_GetEUICCInfo1();
81	
82	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
83	Profile_load_procedure.ES10b_GetEUICCChallenge();
84
85	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
86	ctxParamsForCommonAuthentication = "A13A800400000000A1288003050000810308000082030100008303010000840302000085030200008603090000870302010082080000000011111111";
87	Profile_load_procedure.serverAddress = TEST_DP_ADDRESS1;
88	Profile_load_procedure.ES10b_AuthenticateServer();
89	
90	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
91	Profile_load_procedure.ES10b_PrepareDownload();
92	
93	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
94	Profile_load_procedure.ES10b_GetEID();
95	
96	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage；--Invalid SMDP_Signature");
97	Profile_load_procedure.hostId = "47534D4120534D2D5858";
98	Profile_load_procedure.isErrorTest=true;
99	Profile_load_procedure.remoteOpId ="01";
100	Profile_load_procedure.bppCommandId="00";
101	Profile_load_procedure.errorReason="02";
102	Profile_load_procedure.simaResponse = "";
103	Profile_load_procedure.DPbpInforObj.D_key=curStrHandle.RandHexStr(32);
104	Profile_load_procedure.ES10b_LoadBoundProfilePackage();
105	
106	var errorReason = Profile_load_procedure.profInstallationResult.profileInstallationResultData.finalResult.ErrorResult.errorReason;
107	curStrHandle.CheckData("02", errorReason, "errorReason");
108	
109	RecoverCard();
110}
111
112function TC_eUICC_ES8_InitialiseSecureChannel_03_Error_Invalid_Transaction_Identifier ()
113{
114	
115	tracenamestr = "测试目的：执行InitialiseSecureChannel，transactionId为无效的Transaction Identifier";
116	curDis.TraceStart(sno++,tracenamestr);
117	
118	curDis.TestStepStart2(stno++,"复位；");
119	ResetCard();
120	
121	curDis.TestStepStart2(stno++,"读卡器向卡片发送Terminal Capability命令；");
122	TS_TERMINAL_CAPABILITY_cmd();
123	
124	curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
125	TS_MANAGE_CHANNEL_OPEN();
126	
127	curLogicChannel = 1;
128	
129	curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
130	TS_SELECT("Select ISD",ISD_R_AID,"9000");
131	
132	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
133	var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
134	Profile_load_procedure.ICCID = ICCID_OP_PROF1;
135	Profile_load_procedure.ES10b_GetEUICCInfo1();
136	
137	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
138	Profile_load_procedure.ES10b_GetEUICCChallenge();
139
140	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
141	ctxParamsForCommonAuthentication = "A13A800400000000A1288003050000810308000082030100008303010000840302000085030200008603090000870302010082080000000011111111";
142	Profile_load_procedure.serverAddress = TEST_DP_ADDRESS1;
143	Profile_load_procedure.ES10b_AuthenticateServer();
144	
145	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
146	Profile_load_procedure.ES10b_PrepareDownload();
147	
148	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
149	Profile_load_procedure.ES10b_GetEID();
150	
151	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage；--Invalid_Transaction_Identifier ");
152	var curTransactionId = Profile_load_procedure.authServerRequest.serverSigned1.transactionId;
153	Profile_load_procedure.authServerRequest.serverSigned1.transactionId=curStrHandle.RandHexStr(16);
154	Profile_load_procedure.hostId = "47534D4120534D2D5858";
155	Profile_load_procedure.isErrorTest=true;
156	Profile_load_procedure.remoteOpId ="01";
157	Profile_load_procedure.bppCommandId="00";
158	Profile_load_procedure.errorReason=ErrorReason.invalidTransactionId;
159	Profile_load_procedure.simaResponse = "";
160 	Profile_load_procedure.ES10b_LoadBoundProfilePackage();
161	
162	var errorReason = Profile_load_procedure.profInstallationResult.profileInstallationResultData.finalResult.ErrorResult.errorReason;
163	curStrHandle.CheckData("03", errorReason, "errorReason");
164	
165	RecoverCard();
166}
167
168function TC_eUICC_ES8_InitialiseSecureChannel_04_Error_Invalid_CRT_Values()
169{
170	
171	tracenamestr = "测试目的：执行InitialiseSecureChannel，controlRefTemplate为无效的CRT值";
172	curDis.TraceStart(sno++,tracenamestr);
173
174	curDis.TestStepStart2(stno++,"复位；");
175	ResetCard();
176	
177	curDis.TestStepStart2(stno++,"读卡器向卡片发送Terminal Capability命令；");
178	TS_TERMINAL_CAPABILITY_cmd();
179	
180	curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
181	TS_MANAGE_CHANNEL_OPEN();
182	
183	curLogicChannel = 1;
184	
185	curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
186	TS_SELECT("Select ISD",ISD_R_AID,"9000");
187	
188	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
189	var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
190	Profile_load_procedure.ICCID = ICCID_OP_PROF1;
191	Profile_load_procedure.ES10b_GetEUICCInfo1();
192	
193	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
194	Profile_load_procedure.ES10b_GetEUICCChallenge();
195	
196	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
197	Profile_load_procedure.ES10b_AuthenticateServer();
198	
199	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
200	Profile_load_procedure.ES10b_PrepareDownload();
201	
202	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
203	Profile_load_procedure.ES10b_GetEID();
204	
205	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage；--Invalid CRT Values");
206	Profile_load_procedure.isErrorTest=true;
207	Profile_load_procedure.CRTkeyType = "80";
208	Profile_load_procedure.errorReason="04";
209	Profile_load_procedure.InitialiseSecureChannel();
210	
211	var errorReason = Profile_load_procedure.profInstallationResult.profileInstallationResultData.finalResult.ErrorResult.errorReason;
212	curStrHandle.CheckData("04", errorReason, "errorReason");
213	
214  RecoverCard();
215}
216
217function TC_eUICC_ES8_InitialiseSecureChannel_05_Error_InitialiseSecureChannel_request_while_Secure_Channel_Session_is_ongoing()
218{
219	
220	tracenamestr = "测试目的：安全通道会话已在进行中时，确保eUICC能够拒绝InitialiseSecureChannel请求";
221	curDis.TraceStart(sno++,tracenamestr);
222
223	curDis.TestStepStart2(stno++,"复位；");
224	ResetCard();
225	
226	curDis.TestStepStart2(stno++,"读卡器向卡片发送Terminal Capability命令；");
227	TS_TERMINAL_CAPABILITY_cmd();
228	
229	curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
230	TS_MANAGE_CHANNEL_OPEN();
231	
232	curLogicChannel = 1;
233	
234	curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
235	TS_SELECT("Select ISD",ISD_R_AID,"9000");
236	
237	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
238	var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
239	Profile_load_procedure.ICCID = ICCID_OP_PROF1;
240	Profile_load_procedure.ES10b_GetEUICCInfo1();
241	
242	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
243	Profile_load_procedure.ES10b_GetEUICCChallenge();
244	
245	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
246	Profile_load_procedure.ES10b_AuthenticateServer();
247	
248	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
249	Profile_load_procedure.ES10b_PrepareDownload();
250	
251	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
252	Profile_load_procedure.ES10b_GetEID();
253	
254	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage；--通道已被建立再发InitialiseSecureChannel");
255	Profile_load_procedure.isErrorTest=true;
256	Profile_load_procedure.errorReason="7F";
257	Profile_load_procedure.InitialiseSecureChannelOngoingRejected();
258	
259	var errorReason = Profile_load_procedure.profInstallationResult.profileInstallationResultData.finalResult.ErrorResult.errorReason;
260	curStrHandle.CheckData("7F", errorReason, "errorReason");
261	if(typeof(Profile_load_procedure.profInstallationResult.profileInstallationResultData.notificationMetadata.iccid) == "undefined")
262	{
263		
264		return;
265	}
266	else
267	{
268		obj.SubLevelError ("NotificationMetadata ICCID should be absent");			
269	}	
270	    	
271  RecoverCard();
272}
273

1// Author: 卡思Cas智能体
2// Date: 20261005-152741
3// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES8+.InitialiseSecureChannel，Test Sequence #01–#05（全部 Error 序列）；见 steps 前缀，适用性 M。
4// Test points: S4-C1 SW；S4-C2 SW；S4-C2 resp present；S8-C1 SW；S8-C2 SW；S8-C2 resp present；S12-C1 SW
5//   S12-C2 SW；S12-C2 resp present；S16-C1 SW；S16-C2 SW；S16-C2 resp present；S20-C1 SW；S21-C1 SW
6//   S22-C1 SW acceptable
7// 本函数由 CaseIR 4.2.3.2.1 编译生成（fullwave-blindgen-live-70，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
8// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
9// 适用性 M：编译期门，运行时由 harness 环境前置承担。
10// PRECONDITION (declared, NOT compiled): initial_conditions 缺语料过程体（Annex C.2 absent from input package, corpus vacuum）: IC 序列属测试工具/卡态编排责任，本脚本不虚构初始化步骤；语义影响见 CaseIR open_items。
11// GIC 通信初始化+ISD-R 选择+相互认证+End User Confirmation+PrepareDownload（#PREP_DOWNLOAD_NO_CC）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
12// GIC-sub PROC_EUICC_INITIALIZATION_SEQUENCE（R2 闭合，K_annexC2_procs 表1256：RESET/[SELECT_MF]/[TERMINAL_CAPABILITY_LPAd]/[TERMINAL_PROFILE]）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
13// GIC-sub PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR（R2 闭合，K_annexC2_procs 表1258：[MANAGE_CHANNEL_OPEN]/MTD_SELECT(#ISD_R_AID)）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
14function TC_eUICC_ES8_InitialiseSecureChannel_01_05_Error_steps() {
15    var bind = curBind;
16
17    // 步骤 1：Seq#01 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
18    // test-tool internal preparation (no APDU face): runtime-domain
19    // values per CaseIR unresolved (G Annex B generation rules);
20    // no fabricated bytes emitted here.
21
22    // 步骤 2：Seq#01 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
23    // BPP synthesized (4.2.3.2.1 seq#1, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
24    // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
25    //   [SPEC] TC — SGP.23 4.2.3.2.1 seq#1 接线（段选择/注入面）
26    //   [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
27    //   [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
28    //   [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
29    //   [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
30    //   [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
31    //   [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
32    //   [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
33    //   [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
34    //   [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
35    //   [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
36    //   [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
37    //   [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
38    //   [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
39    //   [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
40    //   [HYPOTHESIS] BF23/82 remoteOpId — 注入 invalid_op_id：未定义 RemoteOpId（4.2.3.2.1 seq#01）
41    //   [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
42    //   [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
43    //   [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
44    //   [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
45    //   [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
46    //   [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
47    //   [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
48    //   [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
49    //   [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
50    //   [SPEC] PE header/version — PITS asn:67-68 2/3
51    //   [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
52    //   [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
53    //   [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
54    //   [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
55    //   [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
56    //   [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
57    //   [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
58    //   [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
59
60    // 步骤 3：Seq#01 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
61    // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
62    // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
63    // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
64    // S3-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
65
66    // 步骤 4：Seq#01 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_162, RQ31_163, RQ55_012, RQ55_015, RQ55_023, RQ25_024, RQ25_025, RQ25_026, RQ35_003_1）
67    // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
68    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
69    var s4 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
70    bind.checkData("S4-C1 SW", "9000", s4.sw);
71    bind.checkData("S4-C2 SW", "9000", s4.sw);
72    bind.checkData("S4-C2 resp present", "1", s4.resp.length > 0 ? "1" : "0");
73    // S4-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
74    // S4-C4: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
75
76    // 步骤 5：Seq#02 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
77    // test-tool internal preparation (no APDU face): runtime-domain
78    // values per CaseIR unresolved (G Annex B generation rules);
79    // no fabricated bytes emitted here.
80
81    // 步骤 6：Seq#02 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
82    // BPP synthesized (4.2.3.2.1 seq#2, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
83    // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
84    //   [SPEC] TC — SGP.23 4.2.3.2.1 seq#2 接线（段选择/注入面）
85    //   [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
86    //   [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
87    //   [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
88    //   [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
89    //   [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
90    //   [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
91    //   [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
92    //   [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
93    //   [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
94    //   [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
95    //   [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
96    //   [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
97    //   [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
98    //   [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
99    //   [HYPOTHESIS] BF23/5F37 smdpSign — 注入 invalid_sign：末字节翻转（4.2.3.2.1 seq#02）
100    //   [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
101    //   [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
102    //   [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
103    //   [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
104    //   [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
105    //   [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
106    //   [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
107    //   [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
108    //   [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
109    //   [SPEC] PE header/version — PITS asn:67-68 2/3
110    //   [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
111    //   [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
112    //   [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
113    //   [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
114    //   [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
115    //   [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
116    //   [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
117    //   [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
118
119    // 步骤 7：Seq#02 IC3: Execute the step IC3 of the Test Sequence #01（切分为 <BPP_SEG_INIT>/<BPP_SEG_A0>/<BPP_SEG_A1>/<BPP_SEG_A3>）（tc_step）
120    // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
121    // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
122
123    // 步骤 8：Seq#02 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_162, RQ31_163, RQ55_011, RQ55_015, RQ25_024, RQ25_025, RQ25_026, RQ35_003_1）
124    // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
125    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
126    var s8 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
127    bind.checkData("S8-C1 SW", "9000", s8.sw);
128    bind.checkData("S8-C2 SW", "9000", s8.sw);
129    bind.checkData("S8-C2 resp present", "1", s8.resp.length > 0 ? "1" : "0");
130    // S8-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
131    // S8-C4: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
132
133    // 步骤 9：Seq#03 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
134    // test-tool internal preparation (no APDU face): runtime-domain
135    // values per CaseIR unresolved (G Annex B generation rules);
136    // no fabricated bytes emitted here.
137
138    // 步骤 10：Seq#03 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
139    // BPP synthesized (4.2.3.2.1 seq#3, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
140    // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
141    //   [SPEC] TC — SGP.23 4.2.3.2.1 seq#3 接线（段选择/注入面）
142    //   [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
143    //   [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
144    //   [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
145    //   [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
146    //   [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
147    //   [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
148    //   [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
149    //   [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
150    //   [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
151    //   [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
152    //   [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
153    //   [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
154    //   [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
155    //   [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
156    //   [HYPOTHESIS] BF23/80 transactionId — 注入 invalid_trans_id：逐字节取反（4.2.3.2.1 seq#03）
157    //   [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
158    //   [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
159    //   [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
160    //   [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
161    //   [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
162    //   [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
163    //   [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
164    //   [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
165    //   [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
166    //   [SPEC] PE header/version — PITS asn:67-68 2/3
167    //   [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
168    //   [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
169    //   [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
170    //   [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
171    //   [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
172    //   [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
173    //   [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
174    //   [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
175
176    // 步骤 11：Seq#03 IC3: Execute the step IC3 of the Test Sequence #01（切分）（tc_step）
177    // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
178    // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
179
180    // 步骤 12：Seq#03 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_162, RQ31_163, RQ55_013, RQ55_015, RQ25_024, RQ25_025, RQ25_026, RQ35_003_1）
181    // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
182    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
183    var s12 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
184    bind.checkData("S12-C1 SW", "9000", s12.sw);
185    bind.checkData("S12-C2 SW", "9000", s12.sw);
186    bind.checkData("S12-C2 resp present", "1", s12.resp.length > 0 ? "1" : "0");
187    // S12-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
188    // S12-C4: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
189
190    // 步骤 13：Seq#04 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
191    // test-tool internal preparation (no APDU face): runtime-domain
192    // values per CaseIR unresolved (G Annex B generation rules);
193    // no fabricated bytes emitted here.
194
195    // 步骤 14：Seq#04 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
196    // BPP synthesized (4.2.3.2.1 seq#4, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
197    // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
198    //   [SPEC] TC — SGP.23 4.2.3.2.1 seq#4 接线（段选择/注入面）
199    //   [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
200    //   [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
201    //   [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
202    //   [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
203    //   [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
204    //   [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
205    //   [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
206    //   [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
207    //   [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
208    //   [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
209    //   [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
210    //   [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
211    //   [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
212    //   [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
213    //   [HYPOTHESIS] BF23/A6/81 keyLen — 注入 invalid_crt：keyLen 0x10→0x20（4.2.3.2.1 seq#04）
214    //   [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
215    //   [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
216    //   [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
217    //   [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
218    //   [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
219    //   [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
220    //   [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
221    //   [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
222    //   [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
223    //   [SPEC] PE header/version — PITS asn:67-68 2/3
224    //   [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
225    //   [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
226    //   [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
227    //   [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
228    //   [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
229    //   [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
230    //   [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
231    //   [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
232
233    // 步骤 15：Seq#04 IC3: Execute the step IC3 of the Test Sequence #01（切分）（tc_step）
234    // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
235    // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
236
237    // 步骤 16：Seq#04 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_162, RQ31_163, RQ55_014, RQ55_015, RQ55_019, RQ25_024, RQ25_025, RQ25_026, RQ35_003_1）
238    // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
239    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
240    var s16 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
241    bind.checkData("S16-C1 SW", "9000", s16.sw);
242    bind.checkData("S16-C2 SW", "9000", s16.sw);
243    bind.checkData("S16-C2 resp present", "1", s16.resp.length > 0 ? "1" : "0");
244    // S16-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
245
246    // 步骤 17：Seq#05 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
247    // test-tool internal preparation (no APDU face): runtime-domain
248    // values per CaseIR unresolved (G Annex B generation rules);
249    // no fabricated bytes emitted here.
250
251    // 步骤 18：Seq#05 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
252    // BPP synthesized (4.2.3.2.1 seq#5, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
253    // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
254    //   [SPEC] TC — SGP.23 4.2.3.2.1 seq#5 接线（段选择/注入面）
255    //   [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
256    //   [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
257    //   [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
258    //   [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
259    //   [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
260    //   [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
261    //   [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
262    //   [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
263    //   [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
264    //   [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
265    //   [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
266    //   [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
267    //   [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
268    //   [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
269    //   [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
270    //   [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
271    //   [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
272    //   [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
273    //   [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
274    //   [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
275    //   [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
276    //   [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
277    //   [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
278    //   [SPEC] PE header/version — PITS asn:67-68 2/3
279    //   [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
280    //   [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
281    //   [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
282    //   [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
283    //   [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
284    //   [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
285    //   [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
286    //   [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
287
288    // 步骤 19：Seq#05 IC3: Execute the step IC3 of the Test Sequence #01（切分）（tc_step）
289    // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
290    // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
291
292    // 步骤 20：Seq#05 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
293    // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
294    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
295    var s20 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
296    bind.checkData("S20-C1 SW", "9000", s20.sw);
297
298    // 步骤 21：Seq#05 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
299    // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
300    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
301    var s21 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
302    bind.checkData("S21-C1 SW", "9000", s21.sw);
303
304    // 步骤 22：Seq#05 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ55_010, RQ57_041_1, RQ57_013, RQ57_016）
305    // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
306    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
307    var s22 = bind.sendApdu(null, "E2", "00", "00", null, "00", null);
308    bind.checkData("S22-C1 SW acceptable", "1", (s22.sw === "6A88" || s22.sw === "6985" || (s22.sw === "9000" && s22.resp.length > 0)) ? "1" : "0");
309    // S22-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
310}
311