diff --git a/reader/STM32CubeExpansion_ALIRO_V1_0_0/Middlewares/ST/rfal/Inc/rfal_isoDep.h b/reader/STM32CubeExpansion_ALIRO_V1_0_0/Middlewares/ST/rfal/Inc/rfal_isoDep.h
index 340e2a9..d769d59 100644
--- a/reader/STM32CubeExpansion_ALIRO_V1_0_0/Middlewares/ST/rfal/Inc/rfal_isoDep.h
+++ b/reader/STM32CubeExpansion_ALIRO_V1_0_0/Middlewares/ST/rfal/Inc/rfal_isoDep.h
@@ -133,7 +133,7 @@
 #define RFAL_ISODEP_MAX_I_RETRYS                (2U)     /*!< Number of retries for a I-Block     Digital 2.0   16.2.5.4                  */
 #define RFAL_ISODEP_MAX_R_RETRYS                (3U)     /*!< Number of retries for a R-Block     Digital 2.0 B9 - nRETRY ACK/NAK: [2,5]  */
 #define RFAL_ISODEP_MAX_WTX_NACK_RETRYS         (3U)     /*!< Number of S(WTX) replied with NACK  Digital 2.0 B9 - nRETRY WTX[2,5]        */
-#define RFAL_ISODEP_MAX_WTX_RETRYS              (20U)    /*!< Number of overall S(WTX) retries    Digital 2.0  16.2.5.2                   */
+#define RFAL_ISODEP_MAX_WTX_RETRYS              (255U)    /* DT: bumped from stock 20 to ULTD (255U) so AUTH1 against our slow userland-GCM applet on j3r452 can finish; reverts to (20U) once we have native GCM */
 #define RFAL_ISODEP_MAX_WTX_RETRYS_ULTD         (255U)   /*!< Use unlimited number of overall S(WTX)                                      */
 #define RFAL_ISODEP_MAX_DSL_RETRYS              (0U)     /*!< Number of retries for a S(DESELECT) Digital 2.0 B9 - nRETRY DESELECT: [0,5] */
 #define RFAL_ISODEP_RATS_RETRIES                (1U)     /*!< RATS retries upon fail              Digital 2.0 B7 - nRETRY RATS [0,1]      */
diff --git a/reader/STM32CubeExpansion_ALIRO_V1_0_0/Projects/nucleo-u5/Applications/Aliro/nfc10-only/Core/Src/aliro_apdu_wrap.c b/reader/STM32CubeExpansion_ALIRO_V1_0_0/Projects/nucleo-u5/Applications/Aliro/nfc10-only/Core/Src/aliro_apdu_wrap.c
index 04b5730..ad05771 100644
--- a/reader/STM32CubeExpansion_ALIRO_V1_0_0/Projects/nucleo-u5/Applications/Aliro/nfc10-only/Core/Src/aliro_apdu_wrap.c
+++ b/reader/STM32CubeExpansion_ALIRO_V1_0_0/Projects/nucleo-u5/Applications/Aliro/nfc10-only/Core/Src/aliro_apdu_wrap.c
@@ -32,10 +32,24 @@ ACWG_Status_t __real_ACWG_processAUTH1ResponsePayload(
 ACWG_Status_t __wrap_ACWG_processAUTH1ResponsePayload(
     ACWG_SessionContext_t *context, uint8_t *payload, uint32_t payloadSize)
 {
-    printf("[AUTH1-RESPONSE len=%u] ", (unsigned)payloadSize);
+    printf("[AUTH1-RESPONSE-IN len=%u] ", (unsigned)payloadSize);
     for (uint32_t i = 0; i < payloadSize && i < 256; i++) {
         printf("%02x", payload[i]);
     }
     printf("\r\n");
-    return __real_ACWG_processAUTH1ResponsePayload(context, payload, payloadSize);
+    ACWG_Status_t ret = __real_ACWG_processAUTH1ResponsePayload(context, payload, payloadSize);
+    printf("[AUTH1-RESPONSE-OUT ret=%d (0x%X)]\r\n", (int)ret, (unsigned)ret);
+    return ret;
 }
+
+/* NOTE: tracing ACWG_computeKDHandVolatileKeys / ACWG_derivePersistentKeys
+ * was attempted via additional __wrap_ functions here, but the linker --wrap
+ * flags in CMakeLists.txt only redirect the two AUTH1 entry points. Adding
+ * the additional wraps without matching CMakeLists --wrap= flags produced a
+ * binary that boots but appears to hang during AUTH1 processing (suspected
+ * unresolved __real_* references being silently turned into broken calls
+ * by --gc-sections). If we need to instrument those inner functions later,
+ * add the matching -Wl,--wrap= flags in CMakeLists.txt first, then restore
+ * the corresponding __wrap_ definitions. For now, the AUTH1-RESPONSE-OUT
+ * return code is enough to identify which subsystem failed inside the
+ * vendor library. */