OEM-unlock flag experiment — the verdict (Track A closed)

Question: does the bit-4 bootloader still read the OEM-unlock flag, or is the unlock path stripped entirely?

Method: write the official flag ourselves, as uid 0, through the official service path, then reboot and observe.

The gate stack (decompiled from services.jar, build F956BXXS4DZI1)

• OemLockService selects the PersistentDataBlockLock backend (no vendor oemlock HAL registered).
• The "carrier" gate is not a carrier check: ```java // PersistentDataBlockLock isOemUnlockAllowedByCarrier() = !UserManager.hasUserRestriction("no_oem_unlock", USER_SYSTEM);

setOemUnlockAllowedByCarrier(z, sig) { // "Signature provided but is not being used" setUserRestriction("no_oem_unlock", !z, USER_SYSTEM); if (!z && flashLocked) pdb.setOemUnlockEnabled(false); // note the side effect } - `setOemUnlockAllowedByUser(z)` gates: (1) `no_factory_reset` restriction → "Admin does not allow OEM unlock"; (2) carrier → "Carrier does not allow OEM unlock"; then writes the device flag. - The device flag is **the last byte of the persistent partition** (+ SHA-256 digest at offset 0):java // PersistentDataBlockService.doSetOemUnlockEnabledLocked channel.position(getBlockDeviceSize() - 1); channel.write(z ? 1 : 0); // then computeAndWriteDigestLocked() `` Getter reads the same last byte. - IOemLockService transactions on this build: 1=getLockName, 2=**setCarrier**, 3=isCarrier, 4=**setUser**, 5=isUser(=device flag), 6=isOemUnlockAllowed, 7=isDeviceOemUnlocked (ro.boot.flash.locked=="0"`).

The write (uid 0)

Kernel-context root shells can't reach servicemanager — fix with runcon while keeping uid 0:

sh runcon u:r:shell:s0 /system/bin/sh -c 'service call oem_lock 2 i32 1' # clear no_oem_unlock runcon u:r:shell:s0 /system/bin/sh -c 'service call oem_lock 4 i32 1' # write device flag

Result: tx3/5/6 all `TRUE`, PDB getter `TRUE`, **persistent last byte = `0x01`**,
digest valid.

## Reboot verdict

ro.boot.other.locked = 1 ro.boot.flash.locked = 1 ro.boot.vbmeta.device_state = locked ro.boot.warranty_bit = 1 ro.oem_unlock_supported = (empty) ````` **The bootloader ignores the flag.** Bonus finding: the flag was alreadyTRUE` from the factory — the bit-4 firmware ships "software unlock allowed" and the abl still refuses. No software state (toggle, PDB flag, restrictions) can unlock this device. The unlock code is gone from the bootloader, not just the Settings UI.

Notes

• An earlier no-arg service call oem_lock 2 probe accidentally called setCarrier(false, null) → set no_oem_unlock=true and cleared the PDB flag (the flash-locked side effect above). That self-inflicted the "Carrier does not allow" refusals seen mid-session. Cleared with the i32 1 call.
• The Settings toggle, if it existed, would call exactly these transactions — it's irrelevant; the consumer of the flag (the abl) is the missing piece.