My read of the proxmark code (https://github.com/RfidResearchGroup/proxmark3/blob/master/client/src/cmdhfmf.c#L6707 https://github.com/RfidResearchGroup/proxmar

My read of the proxmark code (https://github.com/RfidResearchGroup/proxmark3/blob/master/client/src/cmdhfmf.c#L6707 https://github.com/RfidResearchGroup/proxmark3/blob/master/c...) is that the `ndefformat` formatted the tag MAD (https://www.nxp.com/docs/en/application-note/AN10787.pdf https://www.nxp.com/docs/en/application-note/AN10787.pdf), which you'd do for NDEF, then had a single TLV TERMINATOR at the block where the NDEF message starts. Then he used NFC Tools to write on an NDEF text record (which iOS background reading would ignore) and maybe something else? After that he then used `ndefwrite` to write on a URL record. I wonder if he could have skipped the NFC Tools and written the URL record and gotten the same result. Proxmark dumps before and after using NFC Tools would be insightful.