Looking into the SmartRadio protocol, I have found a discrepancy between SDK documentation and the actual data exchanged between devices.
For the advertising packet, the SDK specifies the field order in the vendor extension as:
0x11, // VEX Company ID byte1
0x11, // VEX Company ID byte0
0x01, // MAJOR_VERSION of the radio firmware,
0x01, // MINOR_VERSION of the radio firmware,
0x01, // MAJOR_VERSION of the peripheral’s software
0x05, // MINOR_VERSION of the peripheral’s software
0x00, // The following 32 bits are out SSN (Big Endian)
0x0F, // Example SSN = 987654
0x12,
0x06
but in reality the controller (running 1.5 firmware version) sends:
0x11, // VEX Company ID byte1
0x11, // VEX Company ID byte0
0x01, // MAJOR_VERSION of the radio firmware,
0x01, // MINOR_VERSION of the radio firmware,
0x94, // The following 32 bits are out SSN (**Little** Endian)
0x81, // SSN in my case = 33172
0x00,
0x00
0x01, // MAJOR_VERSION of the peripheral’s software
0x05, // MINOR_VERSION of the peripheral’s software
That is, SSN and peripherial version are swapped and the SSN is sent in little endian.