The length of APDU-AR-DO must not be zero

[ghost]

If APDU-AR-DO contains a generic access rule indicator, the length of
APDU-AR-DO must be 1. If it contains APDU filter(s), the length must be
the number of APDU filter * 8 according to Global Platform Secure
Element Access Control specification.

[ghost]

Please refer to the table 6-8 "APDU-AR-DO" of Secure Element Access Control.

The specification says that the length of APDU-AR-DO is (n * 8) if it contains one or more APDU filter(s). That means that the minimum number of n must be 1, so the length value 0 shall be treated as an invalid data.