I wrote another comment saying I couldn't reproduce but since this is on the front page, I do have a lot of questions for the authors of this CVE. Under their "prevention" section they say manufacturers should use rolling codes. This implies these FOBs don't use them, but per my previous understanding, they do.

Perhaps there is more to the setup of this CVE than they're talking about. Is it possible they're doing a rolljam attack + replay?

The CVE is really scant on details, so while I believe they did manage to get this to work, they don't really say how.

If rolling codes are implemented, it should be pretty simple with the right gear to prove it.