Difference behavior between Windows and MacOS during registration

Here is the relevant portion of the code in pin_uv_auth_precheck():

if auth_param.is_empty() {
    check_user_presence(env, channel)?;
    if storage::pin_hash(env)?.is_none() {
        return Err(Ctap2StatusCode::CTAP2_ERR_PIN_NOT_SET);
    } else {
        return Err(Ctap2StatusCode::CTAP2_ERR_PIN_INVALID);
    }
}

According to Section 6.2.2 of the CTAP specification:

If pinUvAuthParam is zero-length, the authenticator should:
Request evidence of user interaction.
Return CTAP2_ERR_OPERATION_DENIED if the user declines.
Return either CTAP2_ERR_PIN_NOT_SET (if no PIN is set) or CTAP2_ERR_PIN_INVALID (if a PIN is set but invalid).
On Windows, the blank pinUvAuthParam causes the function to fail with CTAP2_ERR_PIN_INVALID, while macOS does not exhibit this issue.

It’s worth noting that the same GetPinUvAuthTokenUsingUvWithPermissions command response is sent to both hosts. My suspicion is that during the registration it might be sending a blank pinUvAuthParam based on the authenticator's response, but the behavior diverges between platforms.

Questions:
Has anyone encountered a similar issue with Windows handling pinUvAuthParam in WebAuthn workflows?
Could this be related to differences in how Windows processes the GetPinUvAuthTokenUsingUvWithPermissions response compared to macOS?
Is this a potential bug in registration, or could the authenticator's implementation be at fault here?
Any guidance on why this discrepancy occurs and how to resolve it would be greatly appreciated. Let me know if additional logs or details are needed for context.

Thank you!
Andrew Jun

The Veridian, Inc.

so basically they tried making it compatible with the 2.1 addition of not needing a pin for a non-resident registration, but forgot a section that checks the pinUvAuthParam and therefore kinda shoots itself.