I'm reading the memory of MIFARE Ultralight tags which have NDEF messages written to them. I'm finding that the NDEF message doesn't begin at the start of a memory block, and I can't tell if this is a defect of the writer, or a part of the spec I'm missing.
If "C" is contactless, probably that. It's got 46bytes of user-writable memory, which matches the MF0ICU1 data sheet. I just don't see anything in that sheet that would make me think that NDEFs shouldn't be aligned to the start of the user memory block.
I might as well answer my own question in case other people run into this.
MIFARE Ultralight tags still begin with a TLV record, not just the NDEF message. The hierarchy is basically TLV->NDEF Message -> NDEF Record. The TLV for NDEF memory consists of 0x03, a 1-byte length field, and then the "payload" consisting of the actual NDEF Message.
You are correct, the NDEF message starts with TLV which defines the type, length and value of the NDEF message. Depending on the memory available on the tag, you could store longer NDEF messages.
Please refer to chapter 2.6.1 for more information about TLV for an NDEF message which is generic when referring to NDEF messages:
Have a nice day!