SM8650 firehose + EDL entry via D+ short cable

Technical update on the locked-bootloader Z Fold 6 (SM-F956B, Snapdragon 8 Gen 3, bit 4).

Two findings this week

1. The "abl is encrypted" myth is dead. The abl is a UEFI FV with an LZMA-compressed inner FV, not AES. Extracted all 5 ABL apps (LinuxLoader, Odin, Cryptest, QuestSOD, QuestUSB). The OEM-unlock code (setOEMFlags/IsUnlocked/GetUnlockCount/milestone) is present in bit-4 — the block is one hardcoded androidboot.other.locked=1 line.

2. Free firehose + EDL entry.

3. adb reboot edl doesn't work on this phone.
4. The XBL contains dpGnd LOW, enter FEDL + boot_fedl_check → the D+ short cable (short D+/green to GND during boot) is the native EDL trigger. No test points needed.
5. Found a free plaintext SM8650 firehose (plaintext ELF, devprg, full command set, UFS, Samsung-signed). The .rtc-wrapped loaders on some repos are the same binary, just AES-DRM'd.

Power off → hold D+→GND short → plug in → FEDL (9008)
edl --loader <sm8650_firehose> printgpt   # bkerler/edl, free

Scope (honest)

Raw UFS read/write below the ABL. The actual unlock is a one-way QFPROM fuse write (TZ-only), which the firehose can't touch, and AVB still applies. It's a powerful tool + brick-safety net, not a magic unlock.

Full writeup (repo, exact filename, SHA256, full unlock chain) → getbackyahroots@gmail.com