How to get incoming ZigBee message data in UART?

Yes, indeed. However, I don't get any event upon receiving data packet in ZigBee. I think some MT modules might not be initialized as I see only few of them in Z-Tool:

So I switched to different project - "C:\ti\Z-Stack Mesh 1.0.0\Projects\zstack\ZNP\CC253x\znp.eww", where Z-Tool detects other MT modules as well:

I am trying to register application endpoint with AF_REGISTER command, but get Status 148 (0xB8):

Are there any particular steps I miss during startup?

Update: I also tried your startup script znp-bringupC.zjs and I don't get any event in Z-Tool upon receiving ZigBee packet. Where to dig?

OK, now I have more subsystems detected in Z-Tool, but I still have same status received upon sending AF_REGISTER

<TX>11:53:09.74 COM15 AF_REGISTER (0x2400)
EndPoint: 0xE8
AppProfID: 0xC105
AppDeviceId: 0x0000
AppDevVer: 0x00
LatencyReq: NO_LATENCY_REQS (0x0)
AppNumInClusters: 0x01
AppInClusterList: 0x0011
AppNumOutClusters: 0x00
AppOutClusterList:

<RX>11:53:09.76 COM15 AF_REGISTER_SRSP (0x6400)
Status: 184 (0xB8)

I think I found something. I uploaded firmware for end device from the same project into the second board from development kit and was able to receive "Hello World" in coordinator (see below comparison of packet from two devices).

I see 3 differences:

1. Different endpoints. I registered endpoint 0xE8 in coordinator, but was able to receive packet addressed to endpoint 0x0A  (updated)

2. Direct Routing in NWK Frame control field. Not sure if absence of this bit can affect somehow. (not confirmed)

3. Encryption at APS layer. Can be the packet is dropped as security is not configured at coordinator.

Any advice here?

Packet from GenericApp - End Device EB

Packet from 3rd party device

Exactly. Do you know which of suspects can be the actual problem?

Sure.

Here is sniffer log for communication with 3rd party device:

20161017 - 3rd party ZED joins ZC and sends packets.psd

I tried to trace calling sequence for afIncomingData, but seems the caller function definition is given in library C:\..\Z-Stack Mesh 1.0.0\Projects\zstack\Libraries\TI2530DB\bin\Router-Pro.lib

Design of this device is quite old, maybe 10 6-8 years ago, it is based on CC2520 chip. Probably at that point there were not many options so vendor made encryption on application layer. Do you think I can get this data out using TIMAC?

In this post I see similar situation (actually opposit, for sending AF encrypted messages)
e2e.ti.com/.../546747
Maybe author knows the solution. Does Dirty Harry still work in TI? :)

Not sure how to help with such old device and unknown protocol. I don't know if Harry is still TI employee. You can send him a friend request and see if he get back to you.

Not for the purpose to put pressure on you, but just for the record: I did same test with ZStack-CC2530-2.3.1-1.4.0. Same story. I get "Hello World" from end device with TI image and don't get messages from 3rd party device. Used GenericApp.
I also noticed that TI end device sends Match Descriptor Request first, before sending other data. However, I don't expect and cannot trigger intentionally sending of Match Descriptor Request from 3rd party device. Do you know if this is mandatory part of ZigBee protocol?