Using the device to view and log CAN traffic over the OBD-II port works simply and effectively. However using the device to transmit CAN messages onto the network seems unsupported if not impossible. CoolTerm can be used to send a serial command which shows up as an infinitely repeating message when CAN-H and CAN-L pins are probed with an Oscilloscope. Additionally formatting seems to violate Bosch GmbH CAN Specification. CAN ECUs on the Network fail to respond to messages generated via the CBT device.

Has anyone successfully used the CBT to transmit authentic CAN messages onto a network?

Im not at all familiar with Subaru or its electronics but you might want to test to tap on to network directly by finding CH & CL wires and try your approach there.
My vehicle (a4 2007) has for example can gateway that filters access to network, i only get data that i request. But jumping onto ch+cl wires reveals naked data as well possibility to inject my own can packets.