OTAA Join-request says MIC mismatch but decoded MIC match

Now Solved

I have a device that I’m trying to onbard to TTN - the device works successfully on Helium - so I thought it would just be a matter of changing the keys and away it would go on TTN. No such luck.
The device live data shows a MIC mismatch error, Yet the decoded packet from my TTN gateway shows the MIC matching. Any clues as to whats going on?

I’m using: https://lorawan-packet-decoder-0ta6puiniaut.runkit.sh/ to decode the packet from the gateway and using the AppKey as the AppSKey.

AppEUI and DevEUI all seem to match up (and are the correct endiness)

This is the Live Data from the Device page (MIC mismatch):

{
  "name": "ns.up.join.cluster.fail",
  "time": "2023-10-10T15:44:33.523546752Z",
  "identifiers": [
    {
      "device_ids": {
        "device_id": "eui-70b3d57ed00619e0",
        "application_ids": {
          "application_id": "pipico-lorawan-test"
        },
        "dev_eui": "70B3D57ED00619E0",
        "join_eui": "6081F9B609A7673F"
      }
    }
  ],
  "data": {
    "@type": "type.googleapis.com/ttn.lorawan.v3.ErrorDetails",
    "namespace": "pkg/joinserver",
    "name": "mic_mismatch",
    "message_format": "MIC mismatch",
    "correlation_id": "69da3b7570c24ee08b4b06a8c553aad5",
    "code": 3
  },
  "correlation_ids": [
    "gs:uplink:01HCD45S78C2ZXHD1D2X4N4SB0"
  ],
  "origin": "ip-10-100-13-242.eu-west-1.compute.internal",
  "context": {
    "tenant-id": "CgN0dG4="
  },
  "visibility": {
    "rights": [
      "RIGHT_APPLICATION_TRAFFIC_READ"
    ]
  },
  "unique_id": "01HCD45S7KMH3PQRGA0ZCS0H1W"
}

and this is the decoded packet from the Gateway (MIC match):

Assuming base64-encoded packet
AD9npwm2+YFg4BkG0H7Vs3CKk4LQaj4=

Message Type = Join Request
  PHYPayload = 003F67A709B6F98160E01906D07ED5B3708A9382D06A3E

( PHYPayload = MHDR[1] | MACPayload[..] | MIC[4] )
        MHDR = 00
  MACPayload = 3F67A709B6F98160E01906D07ED5B3708A93
         MIC = 82D06A3E (from packet)
             = 82D06A3E (expected, assuming 32 bits frame counter with MSB 0000)

( MACPayload = AppEUI[8] | DevEUI[8] | DevNonce[2] )
      AppEUI = 6081F9B609A7673F
      DevEUI = 70B3D57ED00619E0
    DevNonce = 938A

decoded from:

{
  "name": "gs.up.receive",
  "time": "2023-10-10T15:44:33.536277004Z",
  "identifiers": [
    {
      "gateway_ids": {
        "gateway_id": "steves-ttig868",
        "eui": "58A0CBFFFE801F80"
      }
    }
  ],
  "data": {
    "@type": "type.googleapis.com/ttn.lorawan.v3.GatewayUplinkMessage",
    "message": {
      "raw_payload": "AD9npwm2+YFg4BkG0H7Vs3CKk4LQaj4=",
      "payload": {
        "m_hdr": {},
        "mic": "gtBqPg==",
        "join_request_payload": {
          "join_eui": "6081F9B609A7673F",
          "dev_eui": "70B3D57ED00619E0",
          "dev_nonce": "938A"
        }
      },
      "settings": {
        "data_rate": {
          "lora": {
            "bandwidth": 125000,
            "spreading_factor": 12,
            "coding_rate": "4/5"
          }
        },
        "frequency": "868300000",
        "timestamp": 319541324,
        "time": "2023-10-10T15:44:33.468249082Z"
      },
      "rx_metadata": [
        {
          "gateway_ids": {
            "gateway_id": "steves-ttig868",
            "eui": "58A0CBFFFE801F80"
          },
          "time": "2023-10-10T15:44:33.468249082Z",
          "timestamp": 319541324,
          "rssi": -59,
          "channel_rssi": -59,
          "snr": 7.5,
          "location": {
            "latitude": 51.972983407143836,
            "longitude": 1.3708904385566714,
            "altitude": 15,
            "source": "SOURCE_REGISTRY"
          },
          "uplink_token": "ChwKGgoOc3RldmVzLXR0aWc4NjgSCFigy//+gB+AEMygr5gBGgwI4eKVqQYQxKvO/wEg4NGWsaaDAg==",
          "received_at": "2023-10-10T15:44:33.516248996Z"
        }
      ],
      "received_at": "2023-10-10T15:44:33.536057284Z",
      "correlation_ids": [
        "gs:uplink:01HCD45S80HMV2R2E4DNA1VPCF"
      ]
    },
    "band_id": "EU_863_870"
  },
  "correlation_ids": [
    "gs:uplink:01HCD45S80HMV2R2E4DNA1VPCF"
  ],
  "origin": "ip-10-100-13-154.eu-west-1.compute.internal",
  "context": {
    "tenant-id": "CgN0dG4="
  },
  "visibility": {
    "rights": [
      "RIGHT_GATEWAY_TRAFFIC_READ"
    ]
  },
  "unique_id": "01HCD45S80RBVA4YZ04FFDC3P6"
}

A long shot. I had the same problem when I created the device on TTN with wrong arguments. If you have created the device via web page somewhere else is the problem.

Maybe in MSB vs LSB values?

Perhaps swapped the app/join EUI and the device EUI?

Thanks - now working - your post prompted me to create a new device with all the correct parameters - previously I had adjusted the parameters (LoraWAN version etc.) as I went along.