When locked, which comes first, NR_WRITE_PROTECT or message checking?

[sblair]

The Write Protect mechanism is weak security at it's best.... which was all it was meant to be. It can be cracked with a simple for() loop by a malicious controller.

Generally speaking I think it is more useful to give a useful response to the controller. If PID or Command Class is wrong I tend to favor that over the more specific NR codes as there is something more blindingly wrong. If you can tell what the intent of the message was and then you have a WP scenario I would return the NR_WRITE_PROTECT at that point.