GetStatementOfAccountXML: "Only got 0 HICAZ response segments!" after submitTan() when bank omits Bezugselement on HICAZ segment

[KaiWechs]

Environment

• nemiah/php-fints: 4.1.0
• PHP: 8.4
• Bank: HypoVereinsbank / UniCredit Bank GmbH, BLZ 70020270
• TAN mode: 904 (appTAN)

Problem

GetStatementOfAccountXML::execute() triggers a TAN request (HKCAZ + HKTAN step 1) for
a longer date range (7 months). After submitTan(), the bank's response does contain a
valid, complete HICAZ segment with the full CAMT.052 payload — but the library throws:

Fhp\Protocol\UnexpectedResponseException: Only got 0 HICAZ response segments!
  at vendor/nemiah/php-fints/src/Action/GetStatementOfAccountXML.php:166 (line 166 in 4.1.0)

Stack trace:

#0 vendor/nemiah/php-fints/src/FinTs.php(1027): Fhp\Action\GetStatementOfAccountXML->processResponse()
#1 vendor/nemiah/php-fints/src/FinTs.php(516): Fhp\FinTs->processActionResponse()
#2 (my code): Fhp\FinTs->submitTan()

Root cause (as far as I can tell)

FinTs::submitTan() filters the raw response before handing it to the action:

$this->processActionResponse($action, $response->filterByReferenceSegments($action->getRequestSegmentNumbers()));

Message::filterByReferenceSegments() drops any segment whose bezugselement is null:

$referenceNumber = $segment->segmentkopf->bezugselement;
return $referenceNumber !== null && in_array($referenceNumber, $referenceNumbers);

In the raw response from this bank, the HICAZ segment header has no Bezugselement at all
(only two colon-separated fields instead of three):

...HICAZ:4:1+<accountdata>+urn:iso:std:iso:20022:tech:xsd:camt.052.001.08+@9286@<Document ...full valid CAMT.052 XML...>'HITAN:5:6:3+2++<processid>'...

Compare with another bank (Münchner Bank eG) where the same kind of segment does carry a
Bezugselement and everything works:

...HICAZ:6:1:3+<accountdata>+urn:...camt.052...+@...@<Document ...>'HICAZ:7:1:3+...'HITAN:5:6:3+2++<processid>'...

Because the HypoVereinsbank HICAZ segment's Bezugselement is null, it gets silently
dropped by filterByReferenceSegments(), so GetStatementOfAccountXML::processResponse()
counts 0 matching segments and throws — even though the data is present and valid in the raw
response.

Reproduction

1. Connect to HypoVereinsbank (BLZ 70020270) with appTAN (904).
2. GetStatementOfAccountXML::create($account, $from, $to) with a range wide enough that the
   bank requires a TAN for the HKCAZ request (in my case ~7 months).
3. execute(), then submitTan() with the TAN.
4. Exception is thrown despite valid data in the raw response.

This reproduces identically on two independent installations (older phpFinTS install and a
fresh 4.1.0 Composer install), so it doesn't look like a stale-library issue on my end.

Suggested direction (not a PR, just a thought)

Would it make sense for filterByReferenceSegments() (or specifically the codepath in
submitTan()) to also accept segments with bezugselement === null as belonging to the
current action, at least as a fallback if the reference-number filter would otherwise return
zero matching segments of the expected type? Happy to test a patch against my setup if useful,
or to share more of the raw log (redacted) if helpful.