ccid_on_apdu_from_guest() returns an empty DataBlock when no card is
active, but without first setting failed command status. This makes
bStatus report success and leaves bError unset, violating CCID Rev 1.1
section 6.1.4 which requires failed status with ICC_MUTE.

Call ccid_report_error_failed() with ERROR_ICC_MUTE before queuing the
response, matching the existing pattern in the slot-busy error path.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/usb/dev-smartcard-reader.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 208a14dbd1b3..65ceed57541a 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1046,6 +1046,7 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, CCID_XferBlock *recv)
     if (ccid_card_status(s) != ICC_STATUS_PRESENT_ACTIVE) {
         DPRINTF(s, 1,
                 "usb-ccid: not sending apdu to client, no card connected\n");
+        ccid_report_error_failed(s, ERROR_ICC_MUTE);
         ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq);
         return;
     }

-- 
2.55.0