Months reverse-engineering a locked Z Fold 6 bootloader

Bought a Z Fold 6 (SM-F956B) with a locked bootloader and no OEM-unlock toggle. Documenting the whole grind, dead ends included.

Where we are

• ✅ Temp root — KernelSU-Next via GhostLock.
• ✅ Boot chain fully mapped — the abl turned out to be LZMA (not "encrypted" like everyone claimed), so the whole ABL is now RE-able offline.
• ✅ Unlock primitive traced — it's a one-way QFPROM fuse write, TZ-only (not OS-reachable).
• ❌ Three CVEs ruled out (24090 / 24088 / 45779) — none apply to this build.
• 🎯 This week: found a free SM8650 firehose + confirmed EDL entry is a D+ short cable (the boot ROM literally says dpGnd LOW → enter FEDL), not test points, not a paid box.

The honest truth nobody posts

The firehose + EDL gives raw UFS read/write below the ABL — but the actual unlock is a one-way QFPROM fuse that's TZ-only, so the firehose can't flip it. It's a real step forward (raw access + unbrick safety net), but the last gate is still standing.

The detailed writeup (loader repo, filename, hashes, full unlock chain) → getbackyahroots@gmail.com

Own device, temp root only, no writes without backup + recovery.