Channel Sounding Not Working with nRF Toolbox App and nRF54L15-DK

Question

I'm trying to experiment with Bluetooth Channel Sounding using the nRF Toolbox App with an nRF54L15-DK. The app is running on a Google Pixel 10 running Android 16 QPR3 Beta 2. On the DK, I'm using the channel_sounding_ras_reflector app from NCS v3.1.1. These are the only modifications I've made:

CONFIG_BT_BONDABLE=y
CONFIG_BT_CTLR_SDC_CS_MAX_ANTENNA_PATHS=2

I have not made any modifications to the nRF Toolbox app.

The app fails to show any ranging data and gets stuck at "Initiating ranging..."

I have an RFCreations airtrace and can see nRF DK is rejecting the Channel Sounding Start command from the Pixel:

I also see some cases where the Channel Sounding Start appears to succeed:

Here is the CS Configuration being used:

Devices:
Central : 44:A2:8F:A0:48:76, Resolvable private
Peripheral : D2:42:A2:F3:A6:39, Static (Nordic CS Reflector)

"C2P, decrypted, #160509, LE-C: LL_CS_CONFIG_REQ":
Opcode : 0x30 (LL_CS_CONFIG_REQ)
LL_CS_CONFIG_REQ payload:
Config ID : 0x00 (0)
State : 0x1 (Configuration is enabled)
ChM : "0x15555555555554555554 (Used: 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, Unused: 0-1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23-25, 27, 29, 31, 33, 35, 37, 39, 41, 43, 45, 47, 49, 51, 53, 55, 57, 59, 61, 63, 65, 67, 69, 71, 73, 75, 77-79)"
Channel Map Repetition : 0x01 (1)
Main Mode : 0x02 (Mode-2)
Sub Mode : 0xFF (Mode None)
Main Mode Min Steps : 0x00 (0)
Main Mode Max Steps : 0x00 (0)
Main Mode Repetition : 0x00 (0)
Mode 0 Steps : 0x03 (3)
CS SYNC PHY:
LE 1M PHY : 0x1 (Used)
LE 2M PHY : 0x0 (Not Used)
LE Coded PHY : 0x0 (Not Used)
RFU (2M 2BT or S=2 Coded in other PDUs) : 0x0 (Not Used)
RFU : 0x0 (0)

RTT Type : 0x0 (Sync AA only)
Role : 0x0 (Initiator)
IPT : 0x0 (Not Required)
RFU : 0x0 (Not Required)
ChSel : 0x0 (Channel Selection Algorithm 3b)
Ch3c Shape : 0x0 (Hat shape)
Ch3c Jump : 0x03 (Jump 3)
T IP1 : 0x05 (60 µs)
T IP2 : 0x01 (20 µs)
T FCS : 0x06 (80 µs)
T PM : 0x00 (10 µs)
RFU : 0x00 (0)


"P2C, decrypted, #160577, LE-C: LL_CS_CONFIG_RSP":
Opcode : 0x31 (LL_CS_CONFIG_RSP)
LL_CS_CONFIG_RSP payload:
Config ID : 0x00 (0)
RFU : 0x0 (0)

This Reflector DK works fine with another nRF54L15 DK programmed as the Initiator. Here is a diff between the failing config and the succeeding config (using the command "diff CS_Config--nRF54_Succeed CS_Config--Pixel_Fail > CS_Config_Diff.txt"):

1,2c1,2
<  "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#2588, #2616)":
<     "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#2588, #2616)"   : 
---
>  "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#160509, #160577)":
>     "C2P then P2C, decrypted, Channel Sounding Configuration, 2 packets (#160509, #160577)": 
4,5c4,5
<         Central                                                                           : D2:42:A2:F3:A6:39, Static
<         Peripheral                                                                        : CE:E9:DF:96:7C:F8, Static (CS RFLCT 1)
---
>         Central                                                                           : 44:A2:8F:A0:48:76, Resolvable private
>         Peripheral                                                                        : D2:42:A2:F3:A6:39, Static (Nordic CS Reflector)
7c7
<     "C2P, decrypted, #2588, LE-C: LL_CS_CONFIG_REQ":
---
>     "C2P, decrypted, #160509, LE-C: LL_CS_CONFIG_REQ":
12,13c12,13
<             ChM                                                                           : "0x1FFFFFFFFFFFFC7FFFFC (Used: 2-22, 26-76, Unused: 0-1, 23-25, 77-79)"
<             Channel Map Repetition                                                        : 0x03 (3)
---
>             ChM                                                                           : "0x15555555555554555554 (Used: 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, Unused: 0-1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23-25, 27, 29, 31, 33, 35, 37, 39, 41, 43, 45, 47, 49, 51, 53, 55, 57, 59, 61, 63, 65, 67, 69, 71, 73, 75, 77-79)"
>             Channel Map Repetition                                                        : 0x01 (1)
15,17c15,17
<             Sub Mode                                                                      : 0x01 (Mode-1)
<             Main Mode Min Steps                                                           : 0x02 (2)
<             Main Mode Max Steps                                                           : 0x05 (5)
---
>             Sub Mode                                                                      : 0xFF (Mode None)
>             Main Mode Min Steps                                                           : 0x00 (0)
>             Main Mode Max Steps                                                           : 0x00 (0)
33c33
<             Ch3c Jump                                                                     : 0x00 (Unknown)
---
>             Ch3c Jump                                                                     : 0x03 (Jump 3)
36c36
<             T FCS                                                                         : 0x05 (60 µs)
---
>             T FCS                                                                         : 0x06 (80 µs)
41c41
<     "P2C, decrypted, #2616, LE-C: LL_CS_CONFIG_RSP":
---
>     "P2C, decrypted, #160577, LE-C: LL_CS_CONFIG_RSP":

Can you help explain what is going on here?

Thanks,
Chris