diff --git a/client/src/mifare/desfiretest.c b/client/src/mifare/desfiretest.c
index aa9ffebad..350cad4f8 100644
--- a/client/src/mifare/desfiretest.c
+++ b/client/src/mifare/desfiretest.c
@@ -269,26 +269,31 @@ static bool TestEV2IVEncode(void) {
     return res;
 }
 
+// https://www.nxp.com/docs/en/application-note/AN12343.pdf
+// page 54
 static bool TestEV2MAC(void) {
     bool res = true;
 
     uint8_t key[] = {0x93, 0x66, 0xFA, 0x19, 0x5E, 0xB5, 0x66, 0xF5, 0xBD, 0x2B, 0xAD, 0x40, 0x20, 0xB8, 0x30, 0x02};
     uint8_t ti[] = {0xE2, 0xD3, 0xAF, 0x69};
-    uint8_t cmd = 8D;
-    uint8_t cmddata = {0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x00, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 
-                       0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22}
+    uint8_t cmd = 0x8D;
+    uint8_t cmddata[] = {0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x00, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 
+                       0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22};
     uint8_t macres[] = {0x68, 0xF2, 0xC2, 0x8C, 0x57, 0x5A, 0x16, 0x28};
 
+    // init
     DesfireContext ctx = {0};
     ctx.keyType = T_AES;
     memcpy(ctx.sessionKeyMAC, key, 16);
     memcpy(ctx.TI, ti, 4);
     ctx.cmdCntr = 0;
 
+    // tx 1
     uint8_t mac[16] = {0};
     DesfireEV2CalcCMAC(&ctx, cmd, cmddata, sizeof(cmddata), mac);
     res = res && (memcmp(mac, macres, sizeof(macres)) == 0);
 
+    // rx 1
     memset(mac, 0, sizeof(mac));
     uint8_t macres2[] = {0x08, 0x20, 0xF6, 0x88, 0x98, 0xC2, 0xA7, 0xF1};
     uint8_t rc = 0;
@@ -296,12 +301,31 @@ static bool TestEV2MAC(void) {
     DesfireEV2CalcCMAC(&ctx, rc, NULL, 0, mac);
     res = res && (memcmp(mac, macres2, sizeof(macres2)) == 0);
     
+    // tx 2
+    memset(mac, 0, sizeof(mac));
+    cmd = 0xAD;
+    uint8_t cmddata3[] = {0x00, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00};
+    uint8_t macres3[] = {0x0D, 0x9B, 0xE1, 0x91, 0xD5, 0x96, 0x08, 0x34};
+    DesfireEV2CalcCMAC(&ctx, cmd, cmddata3, sizeof(cmddata3), mac);
+    res = res && (memcmp(mac, macres3, sizeof(macres3)) == 0);
+
+    // rx 2
+    rc = 0;
+    ctx.cmdCntr++;
+    uint8_t cmddata4[] = {0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 
+                          0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+    uint8_t macres4[] = {0xA4, 0x9A, 0x44, 0x22, 0x2D, 0x92, 0x66, 0x66};
+    DesfireEV2CalcCMAC(&ctx, rc, cmddata4, sizeof(cmddata4), mac);
+    res = res && (memcmp(mac, macres4, sizeof(macres4)) == 0);
+    
     if (res)
         PrintAndLogEx(INFO, "EV2 MAC calc...... " _GREEN_("passed"));
     else
         PrintAndLogEx(ERR,  "EV2 MAC calc...... " _RED_("fail"));
 
     return res;
+}
 
 bool DesfireTest(bool verbose) {
     bool res = true;