BQ35100: Access the unsealed mode

Hi,

I made a state machine for the different acces modes, but for some reason I'm not able to write to the control status.
Returning the control status, always gives the value 2080, no matter what I write to it.

Writing to the dataFlash works perfectly, I'm able to change config A for example.

void setSecurityMode(uint8_t setState){
    uint8_t data[2]= {0};

    enum states{
        FULL_ACCESS,
        UNSEALED,
        SEALED,
    };

    enum states state = setState;

    switch(state){

        case FULL_ACCESS:
            data[1] = 0xFF;
            data[0] = 0xFF;
            DelayMs(300);
            I2cWriteBuffer(&I2c, 0xAA, 0x3e, data ,2);
            data[1] = 0xFF;
            data[0] = 0xFF;
            DelayMs(300);
            I2cWriteBuffer(&I2c, 0xAA, 0x3e, data ,2);
            DelayMs(300);
            break;

        case UNSEALED:
            data[0] = 0x04;
            data[1] = 0x14;
            DelayMs(300);
            I2cWriteBuffer(&I2c, 0xAA, 0x3e, data ,2);
            data[0] = 0x36;
            data[1] = 0x72;
            DelayMs(300);
            I2cWriteBuffer(&I2c, 0xAA, 0x3e, data ,2);
            break;

        case SEALED:
            data[0] = 0x20;  // First byte of SEALED sub-command (0x20)
            data[1] = 0x00;  // Second byte of SEALED sub-command (0x00) (register address will auto-increment)
            I2cWriteBuffer(&I2c, 0xAA, 0x3E, data ,2);
            DelayMs(100);
            break;
    }
}

Reading the control status:

void controlStatus()
{
    uint8_t bufferRead[2]   =   {0};
    uint8_t bufferWrite[2]  =   {0};
    I2cSetAddrSize( I2C_ADDR_SIZE_8 );
    I2cWriteBuffer(&I2c, 0xAA, 0x00 , bufferWrite, 2);
    DelayMs(100);
    I2cReadBuffer(&I2c,0xAA, 0x00 , bufferRead, 2);
    DelayMs(100);
}

So I found out how to write to the control status:

uint16_t controlSubCmd(uint16_t nSubCmd)
{
    uint16_t nResult = 0;
    uint16_t pData[2] = {0};
    pData[0] = nSubCmd & 0xFF;
    pData[1] = (nSubCmd >> 8) & 0xFF;
    DelayMs(100);
    I2cWriteBuffer(&I2c, 0xAA, 0x00,(uint8_t *)pData, 2); // issue control and sub command
    DelayMs(100);
    I2cReadBuffer(&I2c, 0xAA, 0x00, (uint8_t *)pData, 2); // read data
    DelayMs(100);
    nResult = (pData[1] <<8) | pData[0];
    return nResult;
}

But I'm still not able to change the security mode, even with this command replaced inside the state machine...