Smart Summon unlock is not working.

[Tesla234987234sdf]

Hello,
smart summon unlock is not working. Tested on 2 cars already. It has no function. While traffic sign restore are working. I think this bit need modified too:

CAN ID: 0x3FD
MUX: 1
Byte: 6
Maske: 0x80
Bit: Byte 6 Bit 7
Bit-Nr.: 55

[hypery11]

Thanks for the detailed report — and I see you've raised this in a few places (#139, #162, #168), so let me consolidate the answer here and point the others back to this thread.

The most likely cause is the bus you're injecting on, not a missing bit. Here's why I say that: you've said TLSSC Restore works but Summon EU Unlock does nothing. That split is the tell.

On 2026.14.x and newer (which includes your .26.6.1), the car reads/validates the Vehicle-CAN copy of 0x3FD — and a Party-CAN-only injection of 0x3FD is simply ignored. This was pinned down at the frame level by @mamixsystem in #163 (Party-only 0x3FD → no effect; the car acts on the Vehicle-bus copy). TLSSC Restore is 0x331, which the car reads on the Party bus, so it lands. Summon EU Unlock is 0x3FD, which on your firmware needs to reach the Vehicle-bus copy — so if you're tapped on Party (pins 2/3) only, TLSSC would work and Summon wouldn't, exactly what you're seeing.

Importantly: the recipe itself is confirmed working on-car. @mamixsystem verified the exact bits Summon EU Unlock sets — 0x3FD mux 1, clear bit 19 (EU restriction) + set bit 47 (summon enable) — gave the 6 m unlock. But he was on a dual-CAN tap that reached the Vehicle bus, not Party-only.

So, to pin this down, can you tell me:

1. What hardware/tap are you on, and is it single-CAN? Which pins?
2. If you're Party-only (2/3), that's almost certainly it — Summon on 26.x needs a tap that also reaches the Vehicle bus (a dual-CAN setup like the T-2CAN).
3. A short Listen-Only capture of 0x3FD on your tapped bus would confirm whether the modified frame is even present where the car looks.

On your bit-55 idea (0x3FD mux 1, byte 6, mask 0x80): our Summon path sets only bit 19 + bit 47, which is the pair independently confirmed on-car. bit 55 isn't in that path — if you have a source showing it gates the radius I'll happily look, but "nothing happens at all" plus TLSSC working points at the 0x3FD injection not reaching the checked copy, so I'd rule out the bus first before chasing another bit.

[Tesla234987234sdf]

Thanks for your reply. Im using normal ESP32 device with one twai can bus connected. Can bus is connected to party can. Here is an can log.
tesla_can_20260904_180339.dump.txt