[Galaxy Note 4 Android Development (Snapdragon)] lithium6:
Ok, now that I can confirm that the fingerprint can be made to work (the registration ap is buggy, but you only need it once after all), I tried to look into the encryption issues some more. When I try encrypting directly after a clean install (default R14), with SE enforcing, I get this in logcat:

07-24 12:14:22.877 316 324 D Cryptfs : unmounting /data succeeded
07-24 12:14:22.878 316 324 I Cryptfs : keymaster module name is Keymaster QCOM HAL
07-24 12:14:22.878 316 324 I Cryptfs : keymaster version is 3
07-24 12:14:22.878 316 324 I Cryptfs : Found keymaster0 module, using keymaster0 API.
07-24 12:14:22.878 316 324 D QCOMKeyMaster: keymaster app is loaded
07-24 12:14:22.878 316 324 D QCOMKeyMaster: keymaster app got loaded at attempt number 0
07-24 12:14:22.879 316 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 12:14:22.879 316 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 12:14:22.879 316 324 E QSEECOMAPI: : Error::Cannot open the file /vendor/firmware/keymaster/keymaster.mdt
07-24 12:14:22.879 316 324 E QSEECOMAPI: : Error::Loading image failed with ret = -1
07-24 12:14:22.879 316 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 12:14:22.879 316 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 12:14:22.874 324 324 W vold : type=1400 audit(0.0:310): avc: denied { search } for name="/" dev="mmcblk0p1" ino=1 scontext=u:r:vold:s0 tcontext=u:object_r:firmware_file:s0 tclass=dir permissive=0
07-24 12:14:22.881 316 324 E QSEECOMAPI: : Error::Cannot open the file /firmware/image/keymaste.mdt
07-24 12:14:22.881 316 324 E QSEECOMAPI: : Error::Loading image failed with ret = -1
07-24 12:14:22.881 316 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 12:14:22.881 316 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 12:14:22.881 316 324 E QSEECOMAPI: : Error::Cannot open the file /firmware/image/skeymast.mdt
07-24 12:14:22.881 316 324 E QSEECOMAPI: : Error::Loading image failed with ret = -1
07-24 12:14:22.882 316 324 E QCOMKeyMaster: Loading keymaster app failed
07-24 12:14:22.882 316 324 E Cryptfs : could not open keymaster device in keystore (Operation not permitted)
07-24 12:14:22.882 316 324 E Cryptfs : Failed to init keymaster
07-24 12:14:22.882 316 324 E Cryptfs : keymaster_check_compatibility failed
07-24 12:14:22.882 316 324 E Cryptfs : Error enabling encryption after framework is shutdown, no data changed, restarting system
07-24 12:14:22.874 324 324 W vold : type=1300 audit(0.0:310): arch=40000028 syscall=322 per=800008 success=no exit=-13 a0=ffffff9c a1=b67790ec a2=20000 a3=0 items=1 ppid=1 ppcomm=init auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) exe="/system/bin/vold" subj=u:r:vold:s0 key=(null)
07-24 12:14:22.874 319 319 W auditd : type=1307 audit(0.0:310): cwd="/"
07-24 12:14:22.874 319 319 W auditd : type=1302 audit(0.0:310): item=0 name="/firmware/image/keymaste.mdt" nametype=UNKNOWN
07-24 12:14:22.874 319 319 W auditd : type=1327 audit(0.0:310): proctitle=2F73[...]
07-24 12:14:22.874 319 319 W auditd : type=1320 audit(0.0:310):
07-24 12:14:22.878 324 324 W vold : type=1400 audit(0.0:311): avc: denied { search } for name="/" dev="mmcblk0p1" ino=1 scontext=u:r:vold:s0 tcontext=u:object_r:firmware_file:s0 tclass=dir permissive=0
07-24 12:14:22.878 324 324 W vold : type=1300 audit(0.0:311): arch=40000028 syscall=322 per=800008 success=no exit=-13 a0=ffffff9c a1=b67790ec a2=20000 a3=0 items=1 ppid=1 ppcomm=init auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) exe="/system/bin/vold" subj=u:r:vold:s0 key=(null)
07-24 12:14:22.878 319 319 W auditd : type=1307 audit(0.0:311): cwd="/"
07-24 12:14:22.878 319 319 W auditd : type=1302 audit(0.0:311): item=0 name="/firmware/image/skeymast.mdt" nametype=UNKNOWN
07-24 12:14:22.878 319 319 W auditd : type=1327 audit(0.0:311): proctitle=2F73[...]
07-24 12:14:22.878 319 319 W auditd : type=1320 audit(0.0:311):
07-24 12:14:25.798 1122 1122 E kickstart: ERROR: function: rx_data:292 Read/Write File descriptor returned error: No such device, error code -1
07-24 12:14:25.798 1122 1122 E kickstart: ERROR: function: sahara_main:748 Sahara protocol error

So somehow it can't load the firmware image for the keymaster. It searches in three places, but always fails, even though he third path is correct (the file "skeymast.mdt" actually is there).

Acting on a tip from the internet, I then switched SElinux to permissive (although it feels weird to make one part of the system less secure to make another part moe secure). It looks like, in that case, we actually get one step further:

07-24 21:07:51.859 314 324 D Cryptfs : unmounting /data succeeded
07-24 21:07:51.860 314 324 I Cryptfs : keymaster module name is Keymaster QCOM HAL
07-24 21:07:51.860 314 324 I Cryptfs : keymaster version is 3
07-24 21:07:51.860 314 324 I Cryptfs : Found keymaster0 module, using keymaster0 API.
07-24 21:07:51.858 324 324 I vold : type=1400 audit(0.0:644): avc: denied { read } for name="skeymast.mdt" dev="mmcblk0p1" ino=15 scontext=u:r:vold:s0 tcontext=u:object_r:firmware_file:s0 tclass=file permissive=1
07-24 21:07:51.858 324 324 I vold : type=1400 audit(0.0:644): avc: denied { open } for path="/firmware/image/skeymast.mdt" dev="mmcblk0p1" ino=15 scontext=u:r:vold:s0 tcontext=u:object_r:firmware_file:s0 tclass=file permissive=1
07-24 21:07:51.860 314 324 D QCOMKeyMaster: keymaster app is loaded
07-24 21:07:51.860 314 324 D QCOMKeyMaster: keymaster app got loaded at attempt number 0
07-24 21:07:51.860 314 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 21:07:51.858 324 324 W vold : type=1300 audit(0.0:644): arch=40000028 syscall=322 per=800008 success=yes exit=18 a0=ffffff9c a1=b66f90ec a2=20000 a3=0 items=1 ppid=1 ppcomm=init auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) exe="/system/bin/vold" subj=u:r:vold:s0 key=(null)
07-24 21:07:51.858 319 319 W auditd : type=1307 audit(0.0:644): cwd="/"
07-24 21:07:51.858 319 319 W auditd : type=1302 audit(0.0:644): item=0 name="/firmware/image/skeymast.mdt" inode=15 dev=b3:01 mode=0100444 ouid=1000 ogid=1000 rdev=00:00 obj=u:object_r:firmware_file:s0 nametype=NORMAL
07-24 21:07:51.858 319 319 W auditd : type=1327 audit(0.0:644): proctitle=2F737[...]
07-24 21:07:51.858 319 319 W auditd : type=1320 audit(0.0:644):
07-24 21:07:51.858 324 324 I vold : type=1400 audit(0.0:645): avc: denied { getattr } for path="/firmware/image/skeymast.mdt" dev="mmcblk0p1" ino=15 scontext=u:r:vold:s0 tcontext=u:object_r:firmware_file:s0 tclass=file permissive=1
07-24 21:07:51.861 314 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 21:07:51.861 314 324 E QSEECOMAPI: : Error::Cannot open the file /vendor/firmware/keymaster/keymaster.mdt
07-24 21:07:51.861 314 324 E QSEECOMAPI: : Error::Loading image failed with ret = -1
07-24 21:07:51.861 314 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 21:07:51.861 314 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 21:07:51.861 314 324 E QSEECOMAPI: : Error::Cannot open the file /firmware/image/keymaste.mdt
07-24 21:07:51.861 314 324 E QSEECOMAPI: : Error::Loading image failed with ret = -1
07-24 21:07:51.861 314 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 21:07:51.861 314 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 21:07:51.858 324 324 W vold : type=1300 audit(0.0:645): arch=40000028 syscall=197 per=800008 success=yes exit=0 a0=12 a1=b66f8f98 a2=b66f9014 a3=0 items=0 ppid=1 ppcomm=init auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) exe="/system/bin/vold" subj=u:r:vold:s0 key=(null)
07-24 21:07:51.858 319 319 W auditd : type=1327 audit(0.0:645): proctitle=2F737[...]
07-24 21:07:51.858 319 319 W auditd : type=1320 audit(0.0:645):
07-24 21:07:51.942 314 324 D QSEECOMAPI: : Loaded image: APP id = 2
07-24 21:07:51.943 314 324 D QSEECOMAPI: : QSEECom_dealloc_memory
07-24 21:07:51.943 314 324 D QSEECOMAPI: : QSEECom_shutdown_app, app_id = 2
07-24 21:07:51.944 314 324 I Cryptfs : keymaster module name is Keymaster QCOM HAL
07-24 21:07:51.944 314 324 I Cryptfs : keymaster version is 3
07-24 21:07:51.944 314 324 I Cryptfs : Found keymaster0 module, using keymaster0 API.
07-24 21:07:51.944 314 324 D QCOMKeyMaster: keymaster app is loaded
07-24 21:07:51.944 314 324 D QCOMKeyMaster: keymaster app got loaded at attempt number 0
07-24 21:07:51.944 314 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 21:07:51.944 314 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 21:07:51.945 314 324 E QSEECOMAPI: : Error::Cannot open the file /vendor/firmware/keymaster/keymaster.mdt
07-24 21:07:51.945 314 324 E QSEECOMAPI: : Error::Loading image failed with ret = -1
07-24 21:07:51.945 314 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 21:07:51.945 314 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 21:07:51.945 314 324 E QSEECOMAPI: : Error::Cannot open the file /firmware/image/keymaste.mdt
07-24 21:07:51.945 314 324 E QSEECOMAPI: : Error::Loading image failed with ret = -1
07-24 21:07:51.945 314 324 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
07-24 21:07:51.945 314 324 D QSEECOMAPI: : App is not loaded in QSEE
07-24 21:07:52.024 314 324 D QSEECOMAPI: : Loaded image: APP id = 2
07-24 21:07:52.032 314 324 E QSEECOMAPI: : Error::send command ioctl failed. ret = -1, errno = 22
07-24 21:07:52.032 314 324 E QCOMKeyMaster: Generate key command failed resp->status = -1 ret =-1
07-24 21:07:52.032 314 324 E Cryptfs : Failed to generate keypair
07-24 21:07:52.032 314 324 D QSEECOMAPI: : QSEECom_dealloc_memory
07-24 21:07:52.032 314 324 D QSEECOMAPI: : QSEECom_shutdown_app, app_id = 2
07-24 21:07:52.033 314 324 E Cryptfs : keymaster_create_key failed
07-24 21:07:52.033 314 324 E Cryptfs : Cannot create encrypted master key
07-24 21:07:52.033 314 324 E Cryptfs : Error enabling encryption after framework is shutdown, no data changed, restarting system

So, it appears to load the image ("QSEECOMAPI: : Loaded image: APP id = 2"), but then somehow fails to generate a keypair.

Does someone have an idea what could cause this? Or how to pull further information from the system for debugging?