Windows 11 passkey QR flow: Android shows error, Windows sends 01 00 instead of Shutdown 00

Hi all,

We see the following on every Android phone we tested when creating or using a passkey through the QR code (hybrid) flow from Windows 11. The operation succeeds on the PC and the passkey works, but at the end the phone shows "Something went wrong. Restart the process on your other device to try again." An iPhone shows no error.

Reproduced on:

- Windows 11 25H2, builds 26200.9711 (Enterprise, managed) and 26200.8875 (Pro, unmanaged, no policies)

- Edge 157 and Chrome (both hand the flow to the Windows WebAuthn API)

- webauthn.io and Microsoft Entra ID, attestation none and direct

- Samsung, Pixel and OnePlus phones, Google Password Manager and Samsung Pass

- also on a mobile hotspot without VPN or proxy

What the logs show:

Windows (Event Viewer > Microsoft > Windows > WebAuthN > Operational, verbose events 2332 and 2333). The post-handshake messages are logged as padded plaintext (32 byte granularity, last byte = number of zero padding bytes). The final write message after every registration and authentication is:

01 00 00 00 ... 00 1D

After removing the padding the payload is `01 00`. In caBLE v2 the message types are kShutdown = 0, kCTAP = 1, kUpdate = 2, kJSON = 3 (Chromium, device/fido/cable/v2_constants.h). Chromium ends a session by sending `[0x00]` (Shutdown) and waiting for the phone to close the tunnel (fido_tunnel_device.cc). Windows sends `[0x01, 0x00]`, which is a CTAP message with the invalid command byte 0x00.

Android (adb logcat, Google Play services 26.43.30):

```

[HybridMessageProcessor] Received CTAP message

[HybridMessageProcessor] processing the CTAP message failed for invalid data

Received invalid CTAP command ... can't find command for CTAP request

[HybridResponseHandler] Generic hybrid error: INVALID_CTAP

[HybridErrorFragment] HybridErrorFragment is shown

```

So Google Play services rejects the final Windows message as INVALID_CTAP and shows the error screen, after the credential has already been created or the assertion returned. A very similar bug was fixed in libwebauthn (desktop closed the tunnel without a proper Shutdown): https://github.com/linux-credentials/libwebauthn/pull/310

Questions:

1. Does anyone else see this, with which Windows build and phone?
2. Can someone from Microsoft confirm whether the missing Shutdown message is known and when a fix is planned?
3. Is there a supported workaround until then?

Thanks

Severin