writeString(null) on service-specific exception replies left the message word as 0xFFFFFFFF, which diverges from AOSP keystore2's anyhow-formatted "Error::Rc(NAME)" / "Error::Km(NAME)" strings. Map known ResponseCode/KeyMint codes to their canonical names so the wire shape matches a stock TEE reply.