Use AccessorySetupKit for Accessory Authentication (BLE L2CAP)

PLATFORM AND VERSION iOS Development environment: Xcode Xcode 27.0, macOS macOS Golden Gate 27.0

Run-time configuration: iOS iOS 27.0

DESCRIPTION OF PROBLEM

Environment:

1.I have a BLE hardware development board, The BLE broadcast name is "feature", Integrate an Apple Authentication 4.0 Coprocessor. The phone is iPhone 12 Pro Max, and the system is iOS 27

2.The source code of the app is from https://developer.apple.com/documentation/AccessorySetupKit/setting-up-and-authorizing-a-bluetooth-accessory. Modify the app's identifier from E56A082E-C49B-47CA-A2AB-389127B8ABE4 to F299FC19-5898-4F68-ACE6-E036ABE50781, that is Authenticated Accessory Capability Service of Accessory Authentication (BLE L2CAP).

3.descriptor.supportedOptions = [.bluetoothPairingLE, .bluetoothHID]

Abnormal phenomenon:

1.ASKSample.app paired accessory name "feature" successful, but iPhone just connect accessory and read PSM characteristic every 10s, iPhone not send "LE Credit Based Connection Request - (PSM: 0x0080)".

2.I try set value of Authentication Channel PSM 7401DD11-3558-4459-98EE-371BBFC84C45 to [00, 80] or [80, 00], detailed packet capture of PacketLogger.app(from Additional_Tools_for_Xcode_27) is same, no "LE Credit Based Connection Request - (PSM: 0x0080)".

3.Detailed packet capture of Console.app will show error log "No authorized extension feature, missing services.txt". "NSInvalidArgumentException" is not report from my app.

Question:

1."LE Credit Based Connection Request - (PSM: 0x0080)" is this automatically initiated by the iOS system? Is it necessary for the app to call the code peripheral.openL2CAPChannel(0x0080)? Does the app need to send RequestAuthSetup (0x5100)?

2.Is the code I provided sufficient to complete the testing of Accessory Authentication (BLE L2CAP) without any code modifications? Alternatively, could you provide a Demo app for me to test with Accessory Authentication (BLE L2CAP)?

3.The current Accessory Authentication (BLE L2CAP) testing process has not passed. I have provided two BLE packet captures and one iOS system packet capture to help identify where the problem lies.

log:

1.search "No authorized extension feature, missing services" for error log.

2.20261014_Big-endian_parsing_PSM_Multiple_Read_PSM.pklg and No authorized extension feature, missing services.txt were captured simultaneously. The complete process from "October 14 10:49:10.631" to "October 14 10:49:11.723" in pklg includes connecting, reading PSM, and disconnecting.

error flow of Console.app:

① DADaemonServer 错误 2026-10-14 10:49:11.243577 +0800 No authorized extension feature, missing services: DADevice: ID F202EAF6-578A-4F32-9FB9-668A12D3972F, name 'Blue Dice', Conn < Bluetooth >, btID 3d46f443-883a-ea17-3d63-ae00ec994cd4, btNm feature, flags AccessorySetup, BTPaired, type Hi-Fi Speaker, bluetoothSetupFinished yes, wifiAwareSetupInProgress yes, { DADeviceAppAccessInfo: com.example.apple-samplecode.ASKSample--SAMPLE-CODE-DISAMBIGUATOR-, ID F202EAF6-578A-4F32-9FB9-668A12D3972F, state Authorized, < Bluetooth >, Time 2026-10-14-02:48:46.371, disConfig asID 19D0C4AC-212F-4040-BA0A-EA8783422A0F, btSv [ BLE MFi ], com.example.apple-samplecode.ASKSample--SAMPLE-CODE-DISAMBIGUATOR-, flags 0x22 < BluetoothPairingLE BluetoothHID > }

② Server.LE 默认 2026-10-14 10:49:11.270649 +0800 Adding "needsMFiAuthentication4.0" tag to device "3D46F443-883A-EA17-3D63-AE00EC994CD4"

③ BTLEServer 调试 2026-10-14 10:49:11.282474 +0800 Received XPC message: <OS_xpc_dictionary: <dictionary: 0x7ba5048000> { count = 2, transaction: 1, voucher = 0x101282240, contents = "kMsgId" => <string: 0x7ba5019530> { string cache = 0x0, length = 16, contents = "MFiAccessoryAuth" } "kMsgArgs" => <dictionary: 0x7ba5039080> { count = 1, transaction: 0, voucher = 0x0, contents = "kPeerIdentifier" => <uuid: 0x7ba50194a0> 3D46F443-883A-EA17-3D63-AE00EC994CD4 } }> BTLEServer 默认 2026-10-14 10:49:11.282486 +0800 Performing MFI Auth for CBPeripheral UUID 3D46F443-883A-EA17-3D63-AE00EC994CD4 CoreBluetooth 调试 2026-10-14 10:49:11.282499 +0800 Sending synchronous XPC message CBMsgIdPeerHasTag: { kCBMsgArgDeviceUUID = "3D46F443-883A-EA17-3D63-AE00EC994CD4"; kCBMsgArgName = "needsMFiAuthentication4.0"; }

④ CBStackDeviceMonitor 默认 2026-10-14 10:49:11.375700 +0800 GATT device init completed: Device 3D46F443-883A-EA17-3D63-AE00EC994CD4

⑤ CoreBluetooth 调试 2026-10-14 10:49:11.615127 +0800 Sending XPC message CBMsgIdServiceDiscoverCharacteristics: {kCBMsgArgDeviceUUID = "3D46F443-883A-EA17-3D63-AE00EC994CD4";kCBMsgArgServiceEndHandle = 48;kCBMsgArgServiceStartHandle = 46;kCBMsgArgUUIDs = ("MFi Team ID","MFi Protocol String","MFi Command","MFi Accessory Type","MFi Accessory Attributes","MFi Auth PSM");}

⑥ ASTCommon 信息 2026-10-14 10:49:11.707600 +0800 Reset -- (null) ASTCommon 调试 2026-10-14 10:49:11.707613 +0800 Removing devices: <NSIndexSet: 0xb0a5e8a79a88d37f>[number of indexes: 1 (in 1 ranges), indexes: (0)]

⑦ <缺少描述> 默认 2026-10-14 10:49:11.714044 +0800 *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[__NSPlaceholderDictionary initWithObjects:forKeys:count:]: attempt to insert nil object from objects[1]' *** First throw call stack: (0x184183190 0x183f00380 0x1840fbd9c 0x18417b628 0x100881008 0x10086de44 0x100867e54 0x20abe45d4 0x20abe4670 0x20aba75ec 0x20ab70b10 0x20ab7d454 0x20ab71394 0x1b25dfccc 0x1b25f9fb4 0x1b25e887c 0x1b25e9470 0x1b25ef278 0x1b25ef044 0x1841347a0 0x18412588c 0x1841267f4 0x1845efda8 0x1847ea4d4 0x100858b38 0x183f775b8)

⑧ Packet Logging 调试 2026-10-14 10:49:11.714955 +0800 LOG; 22.612049; 24399DE4-4BCF-44C4-BFC8-3D7636310B99_81C912B0-C4BD-4090-A9A5-51F6034678DF; Bluetooth LE; Event; DETACH; GenericMFi detached!

⑨ Server.LE.Security 默认 2026-10-14 10:49:11.717602 +0800 Removing temporary security keys for device 3D46F443-883A-EA17-3D63-AE00EC994CD4 Server.LE.Security 默认 2026-10-14 10:49:11.727792 +0800 Removing temporary IRK for device 3D46F443-883A-EA17-3D63-AE00EC994CD4

STEPS TO REPRODUCE 1.open ASKSample.xcodeproj, run ASKSample.app on iPhone. 2.click "Add Dice" on app, app will find accessory name "feature", click "Set Up", Accessory Paired successful.

SUPPORT INFORMATION Did someone from Apple ask you to submit a code-level support request? No

Do you have a focused test project that demonstrates your issue? Yes, I have a focused test project to submit with my request

What code level support issue are you having? Problems with an Apple framework API in my app

NAME AND APPLE ID OF APP ASK Sample

All log in attached file.

update crash information:


Translated Report (Full Report Below)

Process: BTLEServer [714] Path: /usr/sbin/BTLEServer Identifier: BTLEServer Version: ??? Code Type: ARM-64 (Native) Role: Unspecified Parent Process: launchd [1] Coalition: com.apple.BTLEServer [345] User ID: 501

Date/Time: 2026-10-17 14:38:42.3418 +0800 Launch Time: 2026-10-17 14:38:41.8662 +0800 Hardware Model: iPhone13,4 OS Version: iPhone OS 27.0 (24A435) Release Type: User Baseband Version: 8.00.01

Crash Reporter Key: 6fca9eb640d4b8476b5d40b6c145e9ec8c352eed Incident Identifier: 0DDF49F0-2D97-4A95-8DE9-D3FADAB86779

Time Awake Since Boot: 1500 seconds

Triggered by Thread: 0, Dispatch Queue: com.apple.main-thread

Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Reason: *** -[__NSPlaceholderDictionary initWithObjects:forKeys:count:]: attempt to insert nil object from objects[2]

Termination Reason: Namespace SIGNAL, Code 6, Abort trap: 6 Terminating Process: BTLEServer [714]

Application Specific Information: abort() called

Last Exception Backtrace: 0 CoreFoundation 0x184cb3190 __exceptionPreprocess + 120 1 libobjc.A.dylib 0x184a30380 objc_exception_throw + 88 2 CoreFoundation 0x184c2bd9c -[__NSPlaceholderDictionary initWithObjects:forKeys:count:] + 764 3 CoreFoundation 0x184cab628 +[NSDictionary dictionaryWithObjects:forKeys:count:] + 52 4 BTLEServer 0x10449d008 0x10444c000 + 331784 5 BTLEServer 0x104489e44 0x10444c000 + 253508 6 BTLEServer 0x104483e54 0x10444c000 + 228948 7 CoreBluetooth 0x20b7145d4 -[CBPeripheral handleAttributeEvent:args:attributeSelector:delegateSelector:delegateFlag:] + 188 8 CoreBluetooth 0x20b714670 -[CBPeripheral handleServiceEvent:serviceSelector:delegateSelector:delegateFlag:] + 100 9 CoreBluetooth 0x20b6d75ec -[CBPeripheral handleMsg:args:] + 384 10 CoreBluetooth 0x20b6a0b10 -[CBCentralManager handleMsg:args:] + 152 11 CoreBluetooth 0x20b6ad454 -[CBManager xpcConnectionDidReceiveMsg:args:] + 256 12 CoreBluetooth 0x20b6a1394 __30-[CBXpcConnection _handleMsg:]_block_invoke + 48 13 libdispatch.dylib 0x1b310fccc _dispatch_call_block_and_release + 32 14 libdispatch.dylib 0x1b3129fb4 _dispatch_client_callout + 16 15 libdispatch.dylib 0x1b311887c _dispatch_lane_serial_drain + 644 16 libdispatch.dylib 0x1b3119470 _dispatch_lane_invoke + 312 17 libdispatch.dylib 0x1b311f278 _dispatch_main_queue_drain + 548 18 libdispatch.dylib 0x1b311f044 _dispatch_main_queue_callback_4CF + 44 19 CoreFoundation 0x184c647a0 CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE + 16 20 CoreFoundation 0x184c5588c __CFRunLoopRun + 1704 21 CoreFoundation 0x184c567f4 _CFRunLoopRunSpecificWithOptions + 344 22 Foundation 0x18511fda8 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212 23 Foundation 0x18531a4d4 -[NSRunLoop(NSRunLoop) run] + 64 24 BTLEServer 0x104474b38 0x10444c000 + 166712 25 dyld 0x184aa75b8 start + 6616

Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 libsystem_kernel.dylib 0x23c5221fc __pthread_kill + 8 1 libsystem_pthread.dylib 0x184b6145c pthread_kill + 268 2 libsystem_c.dylib 0x18c598944 abort + 148 3 libc++abi.dylib 0x2c4553d9c __abort_message + 132 4 libc++abi.dylib 0x2c4558fec demangling_terminate_handler() + 296 5 libobjc.A.dylib 0x184a553c4 _objc_terminate() + 156 6 libc++abi.dylib 0x2c4563c5c std::__terminate(void ()()) + 16 7 libc++abi.dylib 0x2c45658bc __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception) + 88 8 libc++abi.dylib 0x2c4551f74 __cxa_throw + 92 9 libobjc.A.dylib 0x184a304e8 objc_exception_throw + 448 10 CoreFoundation 0x184c2bd9c -[__NSPlaceholderDictionary initWithObjects:forKeys:count:] + 764 11 CoreFoundation 0x184cab628 +[NSDictionary dictionaryWithObjects:forKeys:count:] + 52 12 BTLEServer 0x10449d008 0x10444c000 + 331784 13 BTLEServer 0x104489e44 0x10444c000 + 253508 14 BTLEServer 0x104483e54 0x10444c000 + 228948 15 CoreBluetooth 0x20b7145d4 -[CBPeripheral handleAttributeEvent:args:attributeSelector:delegateSelector:delegateFlag:] + 188 16 CoreBluetooth 0x20b714670 -[CBPeripheral handleServiceEvent:serviceSelector:delegateSelector:delegateFlag:] + 100 17 CoreBluetooth 0x20b6d75ec -[CBPeripheral handleMsg:args:] + 384 18 CoreBluetooth 0x20b6a0b10 -[CBCentralManager handleMsg:args:] + 152 19 CoreBluetooth 0x20b6ad454 -[CBManager xpcConnectionDidReceiveMsg:args:] + 256 20 CoreBluetooth 0x20b6a1394 __30-[CBXpcConnection _handleMsg:]_block_invoke + 48 21 libdispatch.dylib 0x1b310fccc _dispatch_call_block_and_release + 32 22 libdispatch.dylib 0x1b3129fb4 _dispatch_client_callout + 16 23 libdispatch.dylib 0x1b311887c _dispatch_lane_serial_drain + 644 24 libdispatch.dylib 0x1b3119470 _dispatch_lane_invoke + 312 25 libdispatch.dylib 0x1b311f278 _dispatch_main_queue_drain + 548 26 libdispatch.dylib 0x1b311f044 _dispatch_main_queue_callback_4CF + 44 27 CoreFoundation 0x184c647a0 CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE + 16 28 CoreFoundation 0x184c5588c

Use AccessorySetupKit for Accessory Authentication (BLE L2CAP)
 
 
Q