I think some key-on sniff log will help much more. The key is calculated in the main code of pcm, but the ccm comm code is good covered that is hard to get any idea what it does.

I can try to calculate manually some seed-key but needs good pair to match the results.