The play cannot start because one of the KDMs contains an invalid trusted device list (TDL).

Request a KDM with a valid or a generic TDL. Note the ICMP is a permanently married system and doesn't process the TDL but it needs to check that the TDL is properly formatted. For the same reason, the ICMP only provides one certificate while separate IMB - ICP configurations (non-permanently married) would provide 2 distinct certificates.