MUX channel activation: No UA frame received

I try to implement the multiplexer mode with HL6528 (FW 3.0 or 0.18). I read the application manual and code (MUX 0710 linux implementation example).

So I send, after setup SIM Pin etc, the CMUX command to enable the multiplexer:

The I want to open the control channel using a SABM frame:
9f 03 3f 01 1c 97

I expect an UA (DCLI 0) frame as acknowledge, but the modem answers with a SABM frame (echo?) after 9.9ms

a) Why no UA frame is sent (verified with logic analyzer on the physical lines)
b) Is this SABM an echo? I’ve disabled echo earlier (ATE0)
c) Is multiplexer mode working in general with HL6528?

9f 03 3f 01 1c 97
is a typo, should be
f9 03 3f 01 1c f9