[G2 and Desire Z Q&A, Help & Troubleshooting] Phoenix84118:
I'm in a similar situation. I just got a NAM Desire Z, A7275 (from eBay), mine's also S-OFF.

However my bootloader screen shows:

HBOOT-0.85.0012

MICROP-0425

RADIO-26.08.04.16_M

eMMC-boot

Feb 17,2011,16:39:08

I think this may have already been rooted/S-OFF etc...

I can't find an INFOCID using fastboot, but it does say "CID is super CID". This is indeed an unlocked phone.

There was also a su binary already in /system/xbin, so executing 'adb shell' takes me to a root prompt '#'. However even with the Superuser.apk installed, it doesn't ask for permission first. Root is always granted immediately (verified with root app). How can I fix this so it asks for permissions first? I tried replacing the su binary with one from the wiki, and set permissions 2755 on it. No luck, same behavior.

I'm not sure where to proceed since I'm not sure what state the phone is in. I've read the wiki and other forums where there's a risk of brick if I go all out on it.

It has the latest android 2.3.3 w/SenseUI, but I'm not sure what firmware version that corresponds to, to know if I need to downgrade or not.

From the post at: http://xdaforums.com/showthread.php?t=1107911

it says: 'When you check your version at your phone now it should say "1.34"', but I'm not sure where to check that version. Nothing is even close to that number in the 'About Phone' section. It says 'Software number 2.30.405.1', 'HTC Sense version 2.1'.

Is there a risk I can trigger the S-OFF back to S-ON if I flash CM or stock image? I read that reflashing PC10IMG can break stuff.

EDIT: Here's the fastboot oem boot results:

(bootloader) setup_tag addr=0xA0000100 cmdline add=0x8D0878DC

(bootloader) TAG:Ramdisk OK

(bootloader) TAG:smi ok, size = 0

(bootloader) TAG:hwid 0x0

(bootloader) TAG:skuid 0x25203

(bootloader) TAG:hero panel = 0xF

(bootloader) TAG:engineerid = 0x4

(bootloader) MCP dual-die

(bootloader) MCP dual-die

(bootloader) TAG:mono-die = 0x0

(bootloader) Device CID is super CID

(bootloader) CID is super CID

(bootloader) Backup CID is BM___001

(bootloader) setting->cid::BM___001

(bootloader) serial number: HT0xxxxxxxxx

(bootloader) commandline from head: no_console_suspend=1

(bootloader) command line length =492

(bootloader) active commandline: board_vision.disable_uart2=0 board_visio

(bootloader) n.usb_h2w_sw=0 board_vision.disable_sdcard=0 diag.enabled=0

(bootloader) board_vision.debug_uart=0 smisize=0 userdata_sel=0 androidbo

(bootloader) ot.emmc=true androidboot.baseband=26.08.04.16_M androidboot

(bootloader) .cid=BM___001 androidboot.batt_poweron=good_battery androidb

(bootloader) oot.carrier=BM androidboot.mid=PC1012000 androidboot.keycaps

(bootloader) =qwerty androidboot.mode=normal androidboot.serialno=HT0xxxx

(bootloader) xxxxx androidboot.bootloader=0.85.0012 zygote_oneshot=off km

(bootloader) emleak=off no_console_suspend=1

(bootloader) aARM_Partion[0].name=misc

(bootloader) aARM_Partion[1].name=recovery

(bootloader) aARM_Partion[2].name=boot

(bootloader) aARM_Partion[3].name=system

(bootloader) aARM_Partion[4].name=cache

(bootloader) aARM_Partion[5].name=userdata

(bootloader) aARM_Partion[6].name=devlog

(bootloader) aARM_Partion[7].name=pdata

(bootloader) partition number=8

(bootloader) Valid partition num=8

(bootloader) jump_to_kernel: machine_id(2245), tags_addr(0x4000100), kern

(bootloader) el_addr(0x4008000)

(bootloader) -------------------hboot boot time:33453 msec

EDIT2: I've been doing some research, and it appears the ROM I have is a test ROM that was leaked back in March. So my question is, do I have a real S-OFF, or a fake S-OFF (how to tell)? Since I know what ROM it is, at least it gives me some information to work from.