Yale YMF40A (ASSA ABLOY iRevo) - setPinCode command reaches device but PIN is not applied

What happened?

Device

• Model: Yale YMF40A RL
• Zigbee model: 06ffff2027
• Manufacturer: ASSA ABLOY iRevo
• Type: EndDevice (sleepy)
• Battery: 79%

Versions

• Zigbee2MQTT: 2.10.1
• zigbee-herdsman-converters: 26.46.0
• zigbee-herdsman: 10.0.7
• Coordinator: EmberZNet v22.22.2 (revision 7.4.4 GA)

What happened

Setting PIN codes via MQTT stopped working approximately 2 weeks ago. It was working before that. Lock/unlock functionality works correctly.

When sending:
{"pin_code":{"user":1,"user_type":"unrestricted","user_enabled":true,"pin_code":1234}}

to zigbee2mqtt/CERRADURA/set, the command reaches the device (confirmed via logs) but the PIN is not applied on the lock. After sending, the state changes from:
"users":{"1":{"pin_code":"","status":"available"}}
to:
"users":{"1":{"pin_code":{},"status":"available"}}

The pin_code value becomes an empty object {} instead of the actual PIN number. The PIN does not work on the physical keypad.

Error from logs

z2m: Publish 'set' 'state' to 'CERRADURA' failed: 'Error: ZCL command 0x000d6f001790342d/1 closuresDoorLock.unlockDoor({"pincodevalue":{"type":"Buffer","data":[]}}, ...) failed (Delivery failed for '12136'.)'

What did you expect to happen?

What was expected

PIN code should be set on the lock and work on the physical keypad.

Additional info

• expose_pin is set to true in device specific configuration
• Interview of the device fails intermittently with "can not get active endpoints" due to sleepy device behavior
• Device is only compliant to revision 'pre-21' of the Zigbee specification
• Lock is 50cm from a router (Living-dimmer-entrada, TS110E) with good signal (LQI 168/158)
• The pincodevalue is being sent as an empty Buffer instead of the actual PIN digits

How to reproduce it (minimal and precise)

1. Add Yale YMF40A (zigbeeModel: 06ffff2027, ASSA ABLOY iRevo) to network
2. Send to zigbee2mqtt/CERRADURA/set: {"pin_code":{"user":1,"user_type":"unrestricted","user_enabled":true,"pin_code":1234}}
3. Command reaches device, state changes from pin_code:"" to pin_code:{} (empty object)
4. PIN does not work on physical keypad

Zigbee2MQTT version

2.10.1

Adapter firmware version

7.4.4 GA

Adapter

EmberZNet (EZSP)

Setup

Home Assistant add-on on Intel NUC, x86-64

Device database.db entry

No response

Debug log

z2m: Publish 'set' 'state' to 'CERRADURA' failed: 'Error: ZCL command 0x000d6f001790342d/1 closuresDoorLock.unlockDoor({"pincodevalue":{"type":"Buffer","data":[]}}, {"timeout":10000,"disableResponse":false,"disableRecovery":false,"disableDefaultResponse":true,"direction":0,"reservedBits":0,"writeUndiv":false}) failed (Delivery failed for '12136'.)'

After sending {"pin_code":{"user":1,"user_type":"unrestricted","user_enabled":true,"pin_code":1234}} the state changes from:
"users":{"1":{"pin_code":"","status":"available"}}
to:
"users":{"1":{"pin_code":{},"status":"available"}}

Device: Yale YMF40A RL, zigbeeModel: 06ffff2027, ASSA ABLOY iRevo, IEEE: 0x000d6f001790342d
Z2M 2.10.1, zigbee-herdsman-converters 26.46.0, zigbee-herdsman 10.0.7
Coordinator: EmberZNet v22.22.2 revision 7.4.4 GA
expose_pin: true
Device is pre-21 Zigbee spec compliant only
PIN setting worked approximately 2 weeks ago, stopped working after update

Notes

No response

Start at the MQTT set handling for the pin_code payload and trace how it reaches closuresDoorLock.unlockDoor. Compare the supplied PIN value with the empty Buffer shown in the debug log, using the Yale YMF40A reproduction steps. Done means the command applies PIN 1234 and the reported users state contains the expected PIN rather than an empty object.