OK, it turned out the Dimented's tool has a bug. When PCM returns zero seed (0x0000) it means that it's already unlocked. It seems that for some reason the SPS programming after full flash leaves the PCM permanently unlocked.
After the zero seed the flash program should proceed to upload the flash interface without sending key, and the log says that it tries to do that.
The bug is that the tool never sends the mode 34 message in that case, but waits for the PCM mode 34 response.

I resolved this issue with a workaround - I connected ELM327, and when the tool was waiting for mode 34 response ("Skipping security access" in the log) I sent message 6C 10 F0 34 00 09 D6 FF 83 00 - a message that is normally sent after unlockig the PCM.