ISO15693 custom command (0xA1) not responding on PN5180 — need to reproduce CoreNFC behavior (High Data Rate / Selected mode)

[SamBonnard]

Hello,
I am trying to use this library with an ESP32 and a PN5180 module to communicate with an ISO15693 NFC medical sensor (FreeStyle Libre 2 Plus).

The tag responds correctly to the inventory command and returns its UID, but it does not respond at all to custom ISO15693 commands such as 0xA1, 0x20, 0x21, or 0x22.
Context:

• MCU: ESP32 DevKit v1
• Library: PN5180-main
• Wiring: SPI (NSS=5, BUSY=17, RST=16)
• Target: FreeStyle Libre 2+ sensor (Abbott), ISO15693 custom protocol
  What works:

uint8_t uid[8];
if (nfc.getInventory(uid)) {
Serial.println("UID OK:");
for (int i=0;i<8;i++) Serial.printf("%02X ", uid[i]);
}
This correctly prints a UID like: 43 58 AC 12 00 A4 07 E0
What does not work:
When I try to send custom commands such as:

iso15693Send(flags=0x12, cmd=0xA1, uid=nullptr, params=nullptr);
or

iso15693Send(flags=0x22, cmd=0xA1, uid=uid, params=nullptr);
I always get no response (timeout).
The same happens for A1 0x22 (readAttribute) and A1 0x20 (readChallenge).
Expected behavior:
On iPhone using CoreNFC, the following Swift code works:

try await tag.customCommand(
requestFlags: .highDataRate,
customCommandCode: 0xA1,
customRequestParameters: Data()
)

CoreNFC internally performs:

1. Inventory
2. Select (0x25)
3. Sends A1 in Selected + HighDataRate mode (flags = 0x12)
4. Keeps the RF field active between commands
   The tag responds with a payload starting with 0xA5 followed by 24 bytes of data and a CRC16.

What I have tried:

• Keeping the RF field active between commands
• Sending both Selected (0x12) and Addressed (0x22) commands
• Reversing UID byte order (MSB/LSB)
• Trying with and without HighDataRate (0x10 / 0x20) and Option flags (0x52 / 0x62)
• Manually rearming transceive mode using setIdle() and activateTransceive()
  None of these variants produced a response.

Questions:

1. Does the library maintain the RF field active between custom commands, or is it reactivated each time sendBytes() is called?
2. What is the recommended way to send custom ISO15693 commands (like 0xA1) in Selected mode after a Select (0x25)?
3. Should I manually append CRC16 to the transmitted frame, or is that handled internally by the PN5180 firmware?
4. Would it be useful to expose functions like rfOn() and rfOff() for better control of the field state?
   Goal:
I would like to reproduce CoreNFC behavior on the PN5180:

• Send a custom ISO15693 command (A1) in Selected + HighDataRate mode
• Keep the RF field active between commands
• Receive and parse the 28-byte raw response (containing a 24-byte PatchInfo structure)

Thank you for your help and for any insights or examples you can share.
I can provide serial logs or logic analyzer captures if needed.