diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
index b8051ac..fa6792f 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
@@ -28,8 +28,15 @@ class OperationInterceptor(
         val methodName = transactionNames[code] ?: "unknown code=$code"
         logTransaction(txId, methodName, callingUid, callingPid, true)
 
+        // Mirror SoftwareOperation's vendor gate: a real-key op must answer non-AEAD updateAad
+        // exactly as the forged-key path does. Samsung and Xiaomi-MTK TEEs accept it; rejecting
+        // here while the forged path accepts diverges the two and fingerprints the injection.
         if (code == UPDATE_AAD_TRANSACTION && !isAead) {
-            return InterceptorUtils.createServiceSpecificErrorReply(KeystoreErrorCodes.invalidTag)
+            return if (VendorQuirks.nonAeadUpdateAadSucceeds()) {
+                InterceptorUtils.createSuccessReply(writeResultCode = false)
+            } else {
+                InterceptorUtils.createServiceSpecificErrorReply(KeystoreErrorCodes.invalidTag)
+            }
         }
 
         if (code == FINISH_TRANSACTION || code == ABORT_TRANSACTION) {
diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/SoftwareOperation.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/SoftwareOperation.kt
index e3831a2..bf8551c 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/SoftwareOperation.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/SoftwareOperation.kt
@@ -29,7 +29,7 @@ import org.matrix.TEESimulator.logging.SystemLogger
  * device-identity fields the probe reads, so a forged software operation answers exactly as that
  * vendor's real TEE would.
  */
-private object VendorQuirks {
+internal object VendorQuirks {
     private val UPDATE_AAD_ALLOWS_SUCCESS = setOf("samsung")
     private val XIAOMI_BRANDS = setOf("xiaomi", "redmi", "poco")