diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3bda054..96d444d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - HID Prox support (@TeCHiScy)
  - Added cmd for fetching all slots nicks (@Foxushka)
  - Added `hf mf senested` for recovering keys from static encrypted cards via backdoor (https://eprint.iacr.org/2024/1275) (@Foxushka)
- - Added cmd for faster bulk key checking on one block (~33 keys per second) (@Foxushka)
+ - Added cmd for faster bulk key checking on one block (~33 keys per second) (@Foxushka, @taichunmin)
  - Added cmd to acquire nonces for static encrypted cards via backdoor (@Foxushka) 
  - Added `firmware/docker-compose.yml` to build firmware in local docker (@taichunmin)
  - Added cmd to acquire nonces for hardnested(Protocol doc need update) (@xianglin1998)
diff --git a/firmware/application/src/app_cmd.c b/firmware/application/src/app_cmd.c
index a5afcae..83ed28d 100644
--- a/firmware/application/src/app_cmd.c
+++ b/firmware/application/src/app_cmd.c
@@ -390,7 +390,7 @@ static data_frame_tx_t *cmd_processor_mf1_check_keys_of_sectors(uint16_t cmd, ui
 }
 
 static data_frame_tx_t *cmd_processor_mf1_check_keys_on_block(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
-    if (length < 3 || (length - 3) % 6 != 0) {
+    if (length < 9 || data[2] * 6 + 3 != length) {
         return data_frame_make(cmd, STATUS_PAR_ERR, 0, NULL);
     }
 
@@ -401,10 +401,6 @@ static data_frame_tx_t *cmd_processor_mf1_check_keys_on_block(uint16_t cmd, uint
         .keys = (mf1_key_t *) &data[3]
     };
 
-    if ((length - 3) / 6 != in.keys_len) {
-        return data_frame_make(cmd, STATUS_PAR_ERR, 0, NULL);
-    }
-
     mf1_toolbox_check_keys_on_block_out_t out;
     status = mf1_toolbox_check_keys_on_block(&in, &out);
 
diff --git a/firmware/application/src/rfid/reader/hf/mf1_toolbox.c b/firmware/application/src/rfid/reader/hf/mf1_toolbox.c
index 0c84d71..67e3927 100644
--- a/firmware/application/src/rfid/reader/hf/mf1_toolbox.c
+++ b/firmware/application/src/rfid/reader/hf/mf1_toolbox.c
@@ -1292,6 +1292,7 @@ uint16_t mf1_toolbox_check_keys_on_block(
 
     struct Crypto1State mpcs = {0, 0};
     struct Crypto1State *pcs = &mpcs;
+    uint16_t status = STATUS_HF_TAG_OK;
     uint32_t cuid = 0;
     bool have_uid = false;
 
@@ -1299,25 +1300,30 @@ uint16_t mf1_toolbox_check_keys_on_block(
         mf1_toolbox_report_healthy();
 
         if (have_uid == false) {
-            if (pcd_14a_reader_scan_auto(p_tag_info) != STATUS_HF_TAG_OK) {
-                return STATUS_HF_TAG_NO;
+            status = pcd_14a_reader_scan_auto(p_tag_info);
+            if (status != STATUS_HF_TAG_OK) {
+                return status;
             }
             cuid = get_u32_tag_uid(p_tag_info);
             have_uid = true;
         } else {
-            if (pcd_14a_reader_fast_select(p_tag_info) != STATUS_HF_TAG_OK) {
-                return STATUS_HF_TAG_NO;
+            status = pcd_14a_reader_fast_select(p_tag_info);
+            if (status != STATUS_HF_TAG_OK) {
+                return status;
             }
         }
 
         uint32_t nt1 = 0;
         uint64_t key_u64 = bytes_to_num(in->keys[i].key, 6);
-        if (authex(pcs, cuid, in->block, in->key_type, key_u64, AUTH_FIRST, &nt1) == STATUS_HF_TAG_OK) {
-            out->found = 1;
-            out->key = in->keys[i];
-            return STATUS_HF_TAG_OK;
+        status = authex(pcs, cuid, in->block, in->key_type, key_u64, AUTH_FIRST, &nt1);
+        if (status != STATUS_HF_TAG_OK) {
+            if (status == STATUS_HF_TAG_NO) return STATUS_HF_TAG_NO;
+            continue;
         }
+        out->found = 1;
+        out->key = in->keys[i];
+        return STATUS_HF_TAG_OK;
     }
 
-    return STATUS_HF_TAG_NO;
+    return STATUS_MF_ERR_AUTH;
 }