5. Partition map and checksums

The Qualcomm UFS storage on this unit holds 6 LUNs (physical_partition_number 0–5) of 4096-byte sectors in an A/B slotted layout. This page is the verified partition map: every partition’s location, size, presence in the dump, and SHA256 checksum, cross-checked against the images on disk.

5.1. Storage and dump summary

• Storage: Qualcomm UFS, 6 LUNs (physical_partition_number 0–5), 4096-byte sectors, A/B slotted.

• Program entries parsed: 95 across 6 rawprogram XML files.

• SHA256 verification: 106/106 OK, 0 mismatches (shasum -a 256 -c SHA256SUMS, exit 0). This covers every image .bin, every gpt_* table, and each rawprogram XML.

• Only image not present: lun0/userdata.bin (userdata, 12,977,651 sectors ≈ 49.5 GB) — referenced in rawprogram0.xml but excluded from the dump (not in SHA256SUMS). Everything else referenced by XML exists.

• No orphan images: every .bin on disk is accounted for by a rawprogram entry.

• A/B slots are mostly identical — see A/B pairs are mostly identical — with exceptions below. Slot selection itself is carried in GPT attribute bits, not in misc — see Boot-control block (misc) and A/B slot selection.

• Blank (all-0x00) partitions and what each would hold:

  Blank partitions	What they would hold
  keystore, ssd	credential/secure-storage blobs; unprovisioned (keystore is re-confirmed byte-for-byte in Security and DRM userspace)
  apdp, spunvm, secdata, storsec	anti-rollback/DP provisioning, SPU NV, MDTP secure data, secure-storage seed — none provisioned
  mdtp_a/b, mdtpsecapp_a/b	Mobile Device Theft Protection image + data — MDTP disabled (Secure world and coprocessors (TZ, HYP, trustlets))
  catefv, cateloader, catecontentfv, toolsfv, questdatafv	manufacturing / field-diagnostic UEFI FVs — empty on production
  dip, limits-cdsp, cdt	device-info provisioning, CDSP thermal limits, CDT (board identity — decoded in Platform state partitions: cdt, ddr, uefivarstore) — empty
  fsc, fsg	modem filesystem cache/gold — no cellular provisioning
  recovery_b, vbmeta_system_b	slot-B recovery and vbmeta_system — not populated (see below)
  splash (32.6 MB)	boot/charging imagery — XBL disables splash-partition loading, see Splash partition; its zero-hash is unique to its size, so it is not in the shared zero-hash groups below

  The near-blank state partitions — misc (below), devinfo (AVB enforcement code path (LoadImageAndAuth / libavb)), ddr/uefivarstore (Platform state partitions: cdt, ddr, uefivarstore), frp (Security and DRM userspace) — carry a small amount of real structure and are documented on their own pages.

• Not blank, despite sitting next to blank ``fsg``/``fsc``: modemst1/ modemst2 (LUN5) are 99.6% non-zero, real Qualcomm EFS2 modem-NV-store images — see ADSP and CDSP firmware.

5.2. Partition map by LUN

5.2.1. UFS LUN 0 — bulk/userspace (super, userdata, persist, metadata, config)

Label	File	Start sector	Start byte	Sectors	Size	On disk	SHA256 (12)
PrimaryGPT	gpt_main0.bin	0	0x0	6	24 KB	yes	553d3a07a268
ssd	ssd.bin	6	0x6000	2	8 KB	yes	9f1dcbc35c35
persist	persist.bin	8	0x8000	8192	32.0 MB	yes	b956146c9d8c
misc	misc.bin	8200	0x2008000	256	1.0 MB	yes	8da2a417164d
keystore	keystore.bin	8456	0x2108000	128	512 KB	yes	07854d2fef29
frp	frp.bin	8584	0x2188000	128	512 KB	yes	7662a9a143c4
metadata	metadata.bin	8712	0x2208000	4096	16.0 MB	yes	d2c97a8ecdbe
rawdump	rawdump.bin	12808	0x3208000	32768	128.0 MB	yes	254bcc3fc4f2
super	super.bin	45576	0xb208000	1572864	6.00 GB	yes	975b5d1d3815
onyxconfig	onyxconfig.bin	1618440	0x18b208000	6144	24.0 MB	yes	a6afc7373e20
userdata	userdata.bin	1624584	0x18ca08000	12977651	49.51 GB	NO	—
BackupGPT	gpt_backup0.bin	NUM_DISK_SECTORS-5.	(4096*NUM_DISK_SECTORS)-20480.	5	20 KB	yes	edfa5dd867e4

5.2.2. UFS LUN 1 — boot slot A firmware (xbl_a)

Label	File	Start sector	Start byte	Sectors	Size	On disk	SHA256 (12)
PrimaryGPT	gpt_main1.bin	0	0x0	6	24 KB	yes	4de29b8fa3e4
xbl_a	xbl_a.bin	6	0x6000	896	3.5 MB	yes	ec83394b14f8
xbl_config_a	xbl_config_a.bin	902	0x386000	32	128 KB	yes	42b8ae103c6e
BackupGPT	gpt_backup1.bin	NUM_DISK_SECTORS-5.	(4096*NUM_DISK_SECTORS)-20480.	5	20 KB	yes	afaf609b3cfc

5.2.3. UFS LUN 2 — boot slot B firmware (xbl_b)

Label	File	Start sector	Start byte	Sectors	Size	On disk	SHA256 (12)
PrimaryGPT	gpt_main2.bin	0	0x0	6	24 KB	yes	9af7dc6a23e5
xbl_b	xbl_b.bin	6	0x6000	896	3.5 MB	yes	ec83394b14f8
xbl_config_b	xbl_config_b.bin	902	0x386000	32	128 KB	yes	42b8ae103c6e
BackupGPT	gpt_backup2.bin	NUM_DISK_SECTORS-5.	(4096*NUM_DISK_SECTORS)-20480.	5	20 KB	yes	1e3350a79465

5.2.4. UFS LUN 3 — platform config (cdt, ddr)

Label	File	Start sector	Start byte	Sectors	Size	On disk	SHA256 (12)
PrimaryGPT	gpt_main3.bin	0	0x0	6	24 KB	yes	1b7879f22478
ALIGN_TO_128K_1	ALIGN_TO_128K_1.bin	6	0x6000	26	104 KB	yes	caa961e702d5
cdt	cdt.bin	32	0x20000	32	128 KB	yes	fa43239bcee7
ddr	ddr.bin	64	0x40000	256	1.0 MB	yes	c98120889dcb
BackupGPT	gpt_backup3.bin	NUM_DISK_SECTORS-5.	(4096*NUM_DISK_SECTORS)-20480.	5	20 KB	yes	3227169e05a9

5.2.5. UFS LUN 4 — main A/B firmware set (63 partitions)

Label	File	Start sector	Start byte	Sectors	Size	On disk	SHA256 (12)
PrimaryGPT	gpt_main4.bin	0	0x0	6	24 KB	yes	689551751ae6
aop_a	aop_a.bin	6	0x6000	128	512 KB	yes	387c092bff93
tz_a	tz_a.bin	134	0x86000	1024	4.0 MB	yes	6192aa583777
multiimgoem_a	multiimgoem_a.bin	1158	0x486000	8	32 KB	yes	1379dbd89d8e
hyp_a	hyp_a.bin	1166	0x48e000	128	512 KB	yes	687abd6e6de8
modem_a	modem_a.bin	1294	0x50e000	49920	195.0 MB	yes	78aea3b562ad
bluetooth_a	bluetooth_a.bin	51214	0xc80e000	256	1.0 MB	yes	aa37aad18bd2
mdtpsecapp_a	mdtpsecapp_a.bin	51470	0xc90e000	1024	4.0 MB	yes	bb9f8df61474
mdtp_a	mdtp_a.bin	52494	0xcd0e000	8192	32.0 MB	yes	83ee47245398
abl_a	abl_a.bin	60686	0xed0e000	256	1.0 MB	yes	e61d0e6023fd
dsp_a	dsp_a.bin	60942	0xee0e000	16384	64.0 MB	yes	3cf822079d54
keymaster_a	keymaster_a.bin	77326	0x12e0e000	128	512 KB	yes	4ac2570c7a70
boot_a	boot_a.bin	77454	0x12e8e000	24576	96.0 MB	yes	3e3c68d871e2
devcfg_a	devcfg_a.bin	102030	0x18e8e000	32	128 KB	yes	bcd742b788ce
qupfw_a	qupfw_a.bin	102062	0x18eae000	20	80 KB	yes	ff8921c62607
recovery_a	recovery_a.bin	102082	0x18ec2000	24576	96.0 MB	yes	d28a7cb08856
vbmeta_system_a	vbmeta_system_a.bin	126658	0x1eec2000	16	64 KB	yes	54efbab6fac0
vbmeta_a	vbmeta_a.bin	126674	0x1eed2000	16	64 KB	yes	e6de89fc8d3c
dtbo_a	dtbo_a.bin	126690	0x1eee2000	6144	24.0 MB	yes	c17e63f7b247
imagefv_a	imagefv_a.bin	132834	0x206e2000	512	2.0 MB	yes	f0339d3e9952
uefisecapp_a	uefisecapp_a.bin	133346	0x208e2000	512	2.0 MB	yes	b123f4daee04
core_nhlos_a	core_nhlos_a.bin	133858	0x20ae2000	43520	170.0 MB	yes	c12678c8461c
featenabler_a	featenabler_a.bin	177378	0x2b4e2000	32	128 KB	yes	da31d9ba9251
questdatafv	questdatafv.bin	177410	0x2b502000	4096	16.0 MB	yes	080acf35a507
aop_b	aop_b.bin	181506	0x2c502000	128	512 KB	yes	387c092bff93
tz_b	tz_b.bin	181634	0x2c582000	1024	4.0 MB	yes	6192aa583777
multiimgoem_b	multiimgoem_b.bin	182658	0x2c982000	8	32 KB	yes	1379dbd89d8e
hyp_b	hyp_b.bin	182666	0x2c98a000	128	512 KB	yes	687abd6e6de8
modem_b	modem_b.bin	182794	0x2ca0a000	49920	195.0 MB	yes	78aea3b562ad
bluetooth_b	bluetooth_b.bin	232714	0x38d0a000	256	1.0 MB	yes	aa37aad18bd2
mdtpsecapp_b	mdtpsecapp_b.bin	232970	0x38e0a000	1024	4.0 MB	yes	bb9f8df61474
mdtp_b	mdtp_b.bin	233994	0x3920a000	8192	32.0 MB	yes	83ee47245398
abl_b	abl_b.bin	242186	0x3b20a000	256	1.0 MB	yes	e61d0e6023fd
dsp_b	dsp_b.bin	242442	0x3b30a000	16384	64.0 MB	yes	3cf822079d54
keymaster_b	keymaster_b.bin	258826	0x3f30a000	128	512 KB	yes	4ac2570c7a70
boot_b	boot_b.bin	258954	0x3f38a000	24576	96.0 MB	yes	3e3c68d871e2
devcfg_b	devcfg_b.bin	283530	0x4538a000	32	128 KB	yes	bcd742b788ce
qupfw_b	qupfw_b.bin	283562	0x453aa000	20	80 KB	yes	ff8921c62607
recovery_b	recovery_b.bin	283582	0x453be000	24576	96.0 MB	yes	425382d5857f
vbmeta_system_b	vbmeta_system_b.bin	308158	0x4b3be000	16	64 KB	yes	de2f256064a0
vbmeta_b	vbmeta_b.bin	308174	0x4b3ce000	16	64 KB	yes	e6de89fc8d3c
dtbo_b	dtbo_b.bin	308190	0x4b3de000	6144	24.0 MB	yes	c17e63f7b247
featenabler_b	featenabler_b.bin	314334	0x4cbde000	32	128 KB	yes	da31d9ba9251
imagefv_b	imagefv_b.bin	314366	0x4cbfe000	512	2.0 MB	yes	f0339d3e9952
uefisecapp_b	uefisecapp_b.bin	314878	0x4cdfe000	512	2.0 MB	yes	b123f4daee04
core_nhlos_b	core_nhlos_b.bin	315390	0x4cffe000	43520	170.0 MB	yes	c12678c8461c
devinfo	devinfo.bin	358910	0x579fe000	1	4 KB	yes	d8e937106704
dip	dip.bin	358911	0x579ff000	256	1.0 MB	yes	30e14955ebf1
apdp	apdp.bin	359167	0x57aff000	64	256 KB	yes	8a39d2abd399
spunvm	spunvm.bin	359231	0x57b3f000	2048	8.0 MB	yes	2daeb1f36095
splash	splash.bin	361279	0x5833f000	8356	32.6 MB	yes	efd199079045
limits	limits.bin	369635	0x5a3e3000	1	4 KB	yes	e1bf8fa91170
limits-cdsp	limits-cdsp.bin	369636	0x5a3e4000	1	4 KB	yes	ad7facb2586f
toolsfv	toolsfv.bin	369637	0x5a3e5000	256	1.0 MB	yes	30e14955ebf1
logfs	logfs.bin	369893	0x5a4e5000	2048	8.0 MB	yes	b8b5ac87f3d9
cateloader	cateloader.bin	371941	0x5ace5000	512	2.0 MB	yes	5647f05ec189
logdump	logdump.bin	372453	0x5aee5000	16384	64.0 MB	yes	3b6a07d0d404
storsec	storsec.bin	388837	0x5eee5000	32	128 KB	yes	fa43239bcee7
uefivarstore	uefivarstore.bin	388869	0x5ef05000	128	512 KB	yes	8b08214a90a6
secdata	secdata.bin	388997	0x5ef85000	7	28 KB	yes	18619b678a5c
catefv	catefv.bin	389004	0x5ef8c000	128	512 KB	yes	07854d2fef29
catecontentfv	catecontentfv.bin	389132	0x5f00c000	256	1.0 MB	yes	30e14955ebf1
BackupGPT	gpt_backup4.bin	NUM_DISK_SECTORS-5.	(4096*NUM_DISK_SECTORS)-20480.	5	20 KB	yes	387837891ea4

5.2.6. UFS LUN 5 — modem NV storage (modemst/fsg/fsc)

Label	File	Start sector	Start byte	Sectors	Size	On disk	SHA256 (12)
PrimaryGPT	gpt_main5.bin	0	0x0	6	24 KB	yes	286f9c6acc2d
ALIGN_TO_128K_2	ALIGN_TO_128K_2.bin	6	0x6000	26	104 KB	yes	caa961e702d5
modemst1	modemst1.bin	32	0x20000	640	2.5 MB	yes	5e3e83e25ebf
modemst2	modemst2.bin	672	0x2a0000	640	2.5 MB	yes	ceaa31bb4d02
fsg	fsg.bin	1312	0x520000	640	2.5 MB	yes	6de7493c5c90
fsc	fsc.bin	1952	0x7a0000	32	128 KB	yes	fa43239bcee7
BackupGPT	gpt_backup5.bin	NUM_DISK_SECTORS-5.	(4096*NUM_DISK_SECTORS)-20480.	5	20 KB	yes	6321bc650121

5.3. Duplicate-hash groups (byte-identical images)

A/B pairs proving both slots hold the same image, plus blank partitions sharing an all-zero hash.

SHA256 (12)	Files	Note
07854d2fef29	lun0/keystore.bin, lun4/catefv.bin	blank / all-0x00
ec83394b14f8	lun1/xbl_a.bin, lun2/xbl_b.bin	A/B slots identical
42b8ae103c6e	lun1/xbl_config_a.bin, lun2/xbl_config_b.bin	A/B slots identical
e61d0e6023fd	lun4/abl_a.bin, lun4/abl_b.bin	A/B slots identical
387c092bff93	lun4/aop_a.bin, lun4/aop_b.bin	A/B slots identical
aa37aad18bd2	lun4/bluetooth_a.bin, lun4/bluetooth_b.bin	A/B slots identical
3e3c68d871e2	lun4/boot_a.bin, lun4/boot_b.bin	A/B slots identical
c12678c8461c	lun4/core_nhlos_b.bin, lun4/core_nhlos_a.bin	A/B slots identical
bcd742b788ce	lun4/devcfg_b.bin, lun4/devcfg_a.bin	A/B slots identical
30e14955ebf1	lun4/dip.bin, lun4/catecontentfv.bin, lun4/toolsfv.bin	blank / all-0x00
3cf822079d54	lun4/dsp_b.bin, lun4/dsp_a.bin	A/B slots identical
c17e63f7b247	lun4/dtbo_b.bin, lun4/dtbo_a.bin	A/B slots identical
da31d9ba9251	lun4/featenabler_b.bin, lun4/featenabler_a.bin	A/B slots identical
687abd6e6de8	lun4/hyp_a.bin, lun4/hyp_b.bin	A/B slots identical
f0339d3e9952	lun4/imagefv_b.bin, lun4/imagefv_a.bin	A/B slots identical
4ac2570c7a70	lun4/keymaster_b.bin, lun4/keymaster_a.bin	A/B slots identical
83ee47245398	lun4/mdtp_a.bin, lun4/mdtp_b.bin	A/B slots identical
bb9f8df61474	lun4/mdtpsecapp_b.bin, lun4/mdtpsecapp_a.bin	A/B slots identical
78aea3b562ad	lun4/modem_a.bin, lun4/modem_b.bin	A/B slots identical
1379dbd89d8e	lun4/multiimgoem_a.bin, lun4/multiimgoem_b.bin	A/B slots identical
ff8921c62607	lun4/qupfw_b.bin, lun4/qupfw_a.bin	A/B slots identical
6192aa583777	lun4/tz_b.bin, lun4/tz_a.bin	A/B slots identical
b123f4daee04	lun4/uefisecapp_b.bin, lun4/uefisecapp_a.bin	A/B slots identical
e6de89fc8d3c	lun4/vbmeta_b.bin, lun4/vbmeta_a.bin	A/B slots identical
caa961e702d5	lun5/ALIGN_TO_128K_2.bin, lun3/ALIGN_TO_128K_1.bin
fa43239bcee7	lun5/fsc.bin, lun3/cdt.bin, lun4/storsec.bin	blank / all-0x00

5.4. A/B pairs are mostly identical — with exceptions

Most _a/_b firmware pairs are byte-identical (one shared SHA-256, per the duplicate-hash groups above): xbl, xbl_config, boot, tz, abl, vbmeta, dtbo, modem all match across slots. The exceptions are the partitions whose slot B is blank: recovery_b (slot A is a full 100 MB image) and vbmeta_system_b (slot A populated). So the general “both slots equal” picture holds for the core firmware but not for recovery or vbmeta_system.

5.5. Boot-control block (misc) and A/B slot selection

misc.bin (LUN0, 1 MB) is the standard Android/Qualcomm bootloader message block. On this unit it is idle:

• command[0:32], status[32:64], recovery[64:...] — all empty (no pending “boot-recovery” / “bootonce-bootloader” command).

• The AOSP A/B bootloader_control (magic BCAB) is not present in misc — there is no _a/_b suffix or slot struct anywhere in it. Slot state lives in the GPT instead (below).

• A single ~15-byte record sits at 0x8000 (02 b0 0a 74 56 …) — vendor/OTA bookkeeping, not the AOSP slot struct.

So the classic “write a command to misc and reboot to recovery” path exists (the fields are there and ABL’s RESET_PARAM/recovery handling reads them — Physical keys: power, volume, and the boot-mode dispatcher), but slot selection does not go through misc here.

This is a slotted device, but the active-slot / retry / success bookkeeping is carried in the GPT partition-entry attribute field (the top 16 bits of the 8-byte attributes), exactly as ABL’s PartitionTableUpdate.h defines:

Field	Bit(s)	Meaning
PART_ATT_PRIORITY	48–49	2-bit slot priority (0–3); highest wins
PART_ATT_ACTIVE	50	slot is the active/selected one
PART_ATT_MAX_RETRY_CNT	51–53	3-bit remaining boot attempts (0–7)
PART_ATT_SUCCESS	54	slot booted successfully at least once
PART_ATT_UNBOOTABLE	55	slot must not be tried
PART_ATT_READONLY	60	partition is read-only (immutable firmware)

Decoded live from gpt_main4.bin:

Partition	Attributes	Decode
boot_a	0x0077000000000000	prio=3 active=1 retry=6 success=1 — the live, healthy slot
boot_b	0x0000000000000000	prio=0 inactive — dormant/empty slot
xbl_a, tz_a, abl_a, modem_a …	0x1044000000000000	active=1 success=1 ro=1 — immutable firmware, slot A
devcfg_a, dtbo_a, hyp_a, qupfw_a	0x0044000000000000	active=1 success=1 ro=0 — updatable, slot A
firmware _b (populated), most partitions	0x1000000000000000	inactive, ro=1 — slot-B copy present but not selected

This “inactive, ro=1” pattern holds for modem_b, bluetooth_b, mdtpsecapp_b, mdtp_b, abl_b, dsp_b and keymaster_b, but it is not a universal rule: tz_b, hyp_b, aop_b and multiimgoem_b all read 0x0000000000000000 — inactive with no ro bit set at all — even though these are populated, byte-identical firmware (per the previous section, which lists tz as byte-identical across slots). So a firmware-B slot being populated does not guarantee its GPT entry carries ro=1.

The selection rule XBL/ABL implement: among a partition’s slots, pick the highest PRIORITY that is not UNBOOTABLE and has retry > 0; decrement retry per attempt; the OS sets SUCCESS once it confirms a good boot. The READONLY bit (60) cleanly separates the immutable firmware (xbl, tz, aop, modem, abl, dsp, keymaster, vbmeta — ro=1 on their _a slots) from the mutable partitions (boot, recovery, dtbo, devcfg, qupfw, hyp, xbl_config — ro=0); this divides less cleanly on the _b slots (above). A bootloader that replaces ABL must honour these bits (or deliberately ignore slots and boot _a unconditionally, which is valid on a single-active-slot unit like this one).

5.6. GPT type / unique / disk GUIDs

Extracted directly from the gpt_main{0..5}.bin tables (not the rawprogram XML, which carries only labels/offsets). Two structural facts matter for a bootloader that resolves partitions by type GUID rather than by name:

• Every _a slot partition on LUN4 carries a distinct type GUID; every _b slot partition shares one placeholder type GUID 77036cd4-03d5-42bb-8ed1-37e5a88baa34. So a type-GUID lookup uniquely identifies _a partitions but cannot distinguish _b partitions from one another — name-based lookup (as stock ABL uses) has no such asymmetry.

• Per-LUN disk GUIDs: present (one random UUID per LUN, standard GPT disk identity) but not reproduced here — each is unique per physical unit (generated at factory flash time), unlike the type GUIDs below which are fixed by the firmware build and identical across every unit.

Boot-chain _a type GUIDs (LUN1/LUN4), the ones a replacement loader would key on:

Partition	Type GUID
xbl_a (LUN1)	dea0ba2c-cbdd-4805-b4f9-f428251c3e98
xbl_config_a (LUN1)	5a325ae4-4276-b66d-0add-3494df27706a
aop_a	d69e90a5-4cab-0071-f6df-ab977f141a7f
tz_a	a053aa7f-40b8-4b1c-ba08-2f68ac71a4f4
hyp_a	e1a6a689-0c8d-4cc6-b4e8-55a4320fbd8a
abl_a	bd6928a1-4ce0-a038-4f3a-1495e3eddffb
boot_a	20117f86-e985-4357-b9ee-374bc1d8487d
dtbo_a	24d0d418-d31d-4d8d-ac2c-4d4305188450
vbmeta_a	4b7a15d6-322c-42ac-8110-88b7da0c5d77
vbmeta_system_a	1344859d-3a6a-4c14-a316-9e696b3a5400
devcfg_a	f65d4b16-343d-4e25-aafc-be99b6556a6d
recovery_a	d504d6db-fa92-4853-b59e-c7f292e2ea19
devinfo	65addcf4-0c5c-4d9a-ac2d-d90b5cbfcd03

The remaining partitions’ type/unique GUIDs are reproducible from the gpt_main*.bin tables (standard GPT: 92-byte header at the second block, 128-byte entries following; 4096-byte sectors on this unit).

5.7. Provenance

Source:

../_READONLY/rawprogram[0-5].xml (Qualcomm firehose flash descriptors) and the images on disk; ../_READONLY/SHA256SUMS; ../_READONLY/lun[0-5]/gpt_main*.bin (GPT type/unique/disk GUIDs).

Method:

Parse rawprogram[0-5].xml into 95 program entries; cross-check every filename= against files on disk (1 missing: userdata; 0 orphans); run shasum -a 256 -c SHA256SUMS over all ~13 GB (106/106 OK); verify blank partitions with a distinct-byte-value scan (single value 0x00); GPT attribute bits decoded per QcomModulePkg/Include/Library/ PartitionTableUpdate.h.

Cross-refs:

Splash partition (blank splash partition), Security and DRM userspace (persist/metadata/keystore/frp content), ADSP and CDSP firmware (modemst1/2 content), Platform state partitions: cdt, ddr, uefivarstore (cdt/ddr/uefivarstore), AVB enforcement code path (LoadImageAndAuth / libavb) (devinfo lock state), Physical keys: power, volume, and the boot-mode dispatcher (misc/RESET_PARAM recovery path).