The play cannot start because one of the KDMs does not contain a trusted device list (TDL). The KDM should at least reference a generic TDL.

Request a KDM with a valid or a generic TDL. Note the ICMP is a permanently married system and doesn't process the TDL but it needs to check that the TDL is properly formatted. For the same reason, the ICMP only provides one certificate while separate IMB - ICP configurations (non-permanently married) would provide 2 distinct certificates.