Return NotFound for an empty key history object

CHANGELOG.md

@@ -8,6 +8,7 @@
   default (5)
 - Fix the inverted parsing of the touch requirement in SET MANAGEMENT KEY's P2
   (0xFF means no touch, 0xFE means touch required)
+- Answer GET DATA for an empty key history object with NotFound
 
 ## [v0.7.0][] (2026-08-17)
 

src/lib.rs

@@ -1039,6 +1039,11 @@ impl<T: Client> LoadedAuthenticator<'_, T> {
             }
         }
 
+        // Stay absent while there is nothing to report
+        if num_certs == 0 {
+            return Err(Status::NotFound);
+        }
+
         reply.expand(&[0xC1, 0x01])?;
         reply.expand(&[num_certs])?;
         reply.expand(&[0xC2, 0x01])?;

tests/command_response.ron

@@ -13,6 +13,31 @@
             Select
         ]
     ),
+    IoTest(
+        name: "Key history stays absent while empty",
+        cmd_resp: [
+            GetData(
+                input: "5C 03 5FC10C",
+                output: All(),
+                expected_status: NotFound,
+            ),
+            AuthenticateManagement(
+                key: (
+                    algorithm: Tdes,
+                    key: "0102030405060708 0102030405060708 0102030405060708"
+                ),
+                mutual: false,
+            ),
+            // with a certificate stored for a retired slot, the object appears
+            PutData(
+                input: "5C 03 5FC10D 53 04 DEADBEEF",
+            ),
+            GetData(
+                input: "5C 03 5FC10C",
+                output: Data("53 08 C1 01 01 C2 01 00 FE 00"),
+            ),
+        ]
+    ),
     IoTest(
         name: "Bad management key",
         cmd_resp: [