Function write_mac 

pub(crate) fn write_mac(
    session_key: &[u8; 32],
    plaintext: &[u8; 32],
    target_slot: Slot,
    target_block: u8,
    chip_serial: &[u8; 9],
) -> [u8; 32]

Compute the MAC that the chip expects to find appended to the ciphertext in an encrypted write.

session_key is the value of TempKey after Nonce + GenDig, reproduced on the host side via derive_session_key. The io_key itself does not appear directly in this MAC: it has already been absorbed into the session_key, which is the actual block-1 input of the SHA-256 here (see CryptoAuthLib atcah_write_auth_mac).

target_slot is the slot being written (e.g. slot 5 for the PIN hash). target_block is which 32-byte block within the slot (always 0 for our single-block slots).

The slot/block address bytes are derived via [atecc608b::command::read_write::data_address] so this module never duplicates the chip’s address-byte layout: a single source of truth lives in the driver.