if you read PKCS#11 specification, CKU_USER is for the user PIN while CKU_SO is for the PUK or Administration PIN.
if you send the wrong PIN code you get error 160 (wrong PIN).
Probably the PIN is not 4 digits long (1111) but it may have some padding digits that the other tools hide to you. Also, following PKCS#11 specs the PIN is a byte array (byte[]) this means that it may not necessarily be digits but also characters or binary values such as 0xFF.