Can Agilex 3 A3CY100BM16AE7S (AXC3000) use SDM cryptographic services?

Hello,
I would like to confirm whether the SDM cryptographic services (user-mode access through the Mailbox Client IP) are supported on this device:

Device: A3CY100BM16AE7S (Agilex 3 C-Series 100, M16A), Arrow AXC3000 board

Tools: Quartus Prime Pro 26.1 build 110

Mailbox Client IP: Enable C-r-y-p-t-o Service = 1, C-r-y-p-t-o Memory Timeout = 10000, AXI manager connected to an on-chip RAM (confirmed in the compile log: intel_memory_initiator_endpoint with has_offload=1)

Access: from fabric over Avalon-MM, no HPS

What I observe (3 runs each, identical results, response FIFO empty after each command):

- NOOP -> response header 0x00000000 (OK)

- GET_IDCODE (0x10) -> header 0x00001000, data 0x4361B0DD (OK)

- GET_CHIPID (0x12), GET_USERCODE (0x13), GET_TEMPERATURE (0x19), CONFIG_STATUS (0x04) -> all return the documented response lengths

- open_crypto_service_session (0xA0) -> header 0x00001085 (error code 0x085, LENGTH=1), data word 0x000000FF

- close_crypto_service_session, random_number_request, aes_crypt_request, get_digest_request, ecdsa sign/verify, ecdh_request -> header error code 0x085 (LENGTH=0)

What the documentation says:

- Agilex 3 C-Series Product Table (2026.02.11): specification code Y has C-r-y-p-t-o = No ("user mode access to the SDM hardened cryptographic IP"); codes U and W have C-r-y-p-t-o = Yes.

- Security TRM: the error table of open_crypto_service_session lists both 0x0F (function not supported on the device) and 0x85 (command not allowed under the current security settings).

- Security Overview for SDM-based devices, section 2.6, says the SDM C-r-y-p-t-o engines are made available to the FPGA design through the mailbox in user mode, without mentioning per-device restrictions.

Questions:

1. Does A3CY100BM16AE7S (spec code Y) support SDM cryptographic services through the Mailbox Client IP?

2. If not, is 0x085 the expected response, or should it be 0x0F?

3. If the device is supposed to support them, what could make the SDM reject the command with 0x085 (security settings, provisioning, initialization)?

4. Is there any supported way to enable these services on this device?

Thank you.