From both the NCE USB v7 doc (see NCE web site) or from

http://jmri.sourceforge.net/help/en/package/jmri/jmrix/nce/packetgen/NcePacketGenFrame.shtml

Example: 0xAD is for switching an Accy/Signal. There is no provision to read the state.

• E.g. 0xAD 0x00 0x03 0x03 0x00 ⇒ throw 0x0003 in normal direction
• E.g. 0xAD 0x00 0x03 0x04 0x00 ⇒ throw 0x0003 in reverse direction
• 0 is an invalid address.
• Max address is 2044 (0x7FC) which is a broadcast address for Accy.

Note: when trying in JMRI > NCE Command, "Binary" means hex without x, seriously \o/ ?

Lockout CV 556:

• Use on Address of input #1, which is 4 for my home one.
• 556 = 0x022C
• 0xAF is Ops ACCY programming.
• AF 00 04 02 2C [0=unlocked | 1=locked]
• This works. It locks buttons out.
• ACCY on controller can still be used to throw turnouts.

That means I can trivially command that from an Arduino and bypass JMRI if needed.