All recovery methods that involve resetting the PIN are currently not supported.
You can read it in non-critical issues in the release notes.
I had a support case to get Information when it will be resolved, but they dont know.
So you must do a machine recovery to get the system running, and then you need to use a method to reset the smartcard Pin (we use Rsa Control Center and the Pin unblock Wizard)
Hope this helps
You are correct. For non password tokens, to reset them use the system the token manufacturer offers. Most "hard" tokens can only be reset that way.