PIN-protected accounts can log in, as in 1.12.1.
- **The challenge:** a non-zero security byte (`0x5bab5a`) carries the grid seed and salt. The logon reports the PIN state, and the stock keypad opens on `PLAYER_ENTER_PIN` with the grid built as `0x5b1e70` does.
- **`PINEntered`** takes 4 to 10 keys (`0x46d1c0`). It builds the proof, `SHA1(client salt ‖ SHA1(server salt ‖ digits))` (`0x5b31e0`), and sends it after the security byte (`0x5bbc80`).
- **A refused PIN** shows the PIN texts 8, 8, then 9 (`0x5b2d00`); a success resets the count.
- **The realm-list re-dial** forgets the PIN after a refusal rather than retrying into the server's lockout. The PIN is never logged.
Byte-exact goldens cover the proof and the grid. A fake realmd checks the proof as vmangos does (`AuthSocket.cpp:1204`).
Fixes#1110🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sam Sung
7a403d0506