I'd be interested in the specific commands/spec too, however as with all DRM techs I wouldn't be surprised if it's hidden behind NDAs.

However you can see from the parent comment:

> Success of mutual authentication enables host to access card protected area.

So it's something the memory control must make available after a handshake, and then I presume either some specific memory address or set of retrieval commands would follow.

As you mention, it also states this spec is now optional.

This seems to be the spec in question: https://picture.iczhiku.com/resource/eetop/wYKESjuFHlDHkbcM....