Free SM8650 firehose for the locked Z Fold 6

Locked-bootloader Z Fold 6 (SM-F956B, Snapdragon 8 Gen 3, bit 4). Samsung removed the OEM-unlock option. We've been reverse-engineering it for months, and this week we hit two big wins:

• Found a free, plaintext SM8650 firehose programmer. The "free" loaders floating around are mostly AES-encrypted DRM (.rtc container) so a vendor can sell the key — but the plaintext one was sitting in a public repo the whole time. Verified: plaintext ELF, devprg, full command set (program/read/patch/erase/configure/nop/getstorageinfo/firmwarewrite), UFS, Samsung-signed.
• Solved EDL entry. adb reboot edl does nothing on this phone (just reboots). But the boot ROM itself contains dpGnd LOW, enter FEDL — which is the D+ short cable (short the green/data+ wire to ground during boot). So no test points, no paid box.

The whole route is now $0 + a ~$10 DIY cable: firehose free, clients free, no UnlockTool/Chimera, no capture, no DRM crack.

Honest caveat: the firehose gives raw UFS read/write below the ABL — it does not blow the QFPROM fuse (that's TZ-only) and does not bypass AVB. It's the tool that opens the last doors + a brick-safety net, not a magic unlock button.

For the full writeup (repo, loader name, hashes, full unlock chain) → getbackyahroots@gmail.com