Counter rollback via interrupted RFID writes

Improper counter protection in NXP MIFARE Ultralight and NTAG cards allows physically proximate attackers to reset monotonic counters over RFID. The anti-tearing logic stores a counter in two EEPROM slots and trusts a valid flag while returning the higher slot, allowing timed interrupted increments to create weak bits and force a rollback. The attacker must repeatedly control the reader field and card distance; success can restore a spent ticket or bypass another application control that relies on the counter.