return BAD_OTP on *any* KSM failure