At first it looked liked he found a way to try as many passcodes as he wanted without destroying data. But it turned out the passcodes he tested weren’t always counted.