Something like this script should be implemented by gpg frontend:

It doesn't work because I did mistake for the salt of reset code, it should be 8-byte instead of 4-byte.
Here is a fixed version, which I tested with Gnuk 1.2.8:

Sorry again. My script was still wrong (didn't work).

Here is a final script, which works for my Gnuk Token version 1.2.8.
I confirmed it's working well.
The fix are (1) a typo of hex value: 02->82, (2) s2k count should be in hex.

I realized that: once KDF-DO is written to smartcard/token, factory-reset command won't work because it assumes standard PIN format than hashed.

For factory-reset, rG2c85e202bc30: scd: Better user interaction for factory-reset. fixed the issue.