APP_UNEXPECTED

Generic case, which must not happen for an authentic app. could be borked assertion data (initial counter not zero, invalid attestation data, etc, KID mismatch). In general, it is hard to tell whether app developers made a mistake or something fishy is going on