Keychain: Item reported as errSecItemNotFound, but receive errSecDuplicateItem on addition

The unique key for kSecClassGenericPassword is composed of;

kSecAttrAccount
kSecAttrService

To check for its existence, query the keychain store with only these attributes (including kSecReturnAttributes flag).

Including kSecAttrLabel and kSecAttrAccessible will exclude any existing item with the same unique key, but with different attributes.

Once you have confirmed its (non)existence, add the additional attributes and Add or Update.